danabot | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
180s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

danabot banker botnet discovery trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x000700000000074d-392.dat	family_danabot

Blocklisted process makes network request 3 IoCs

flow	pid	Process
91	440	rundll32.exe
97	440	rundll32.exe
98	440	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3504	DanaBot.exe

Loads dropped DLL 3 IoCs

pid	Process
1692	regsvr32.exe
440	rundll32.exe
440	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
82	raw.githubusercontent.com
83	raw.githubusercontent.com
84	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	3504	WerFault.exe	126

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 715941.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2096	msedge.exe
2096	msedge.exe
2568	identity_helper.exe
2568	identity_helper.exe
4076	msedge.exe
4076	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	taskmgr.exe
Token: SeSystemProfilePrivilege	4512	taskmgr.exe
Token: SeCreateGlobalPrivilege	4512	taskmgr.exe
Token: 33	4512	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4512	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe
4512	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2728	2096	msedge.exe	84
PID 2096 wrote to memory of 2728	2096	msedge.exe	84
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2140	2096	msedge.exe	85
PID 2096 wrote to memory of 2824	2096	msedge.exe	86
PID 2096 wrote to memory of 2824	2096	msedge.exe	86
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87
PID 2096 wrote to memory of 544	2096	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9189546f8,0x7ff918954708,0x7ff918954718
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,820714480881276877,12621479234602163454,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:324
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3504
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@3504
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1692
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 464
    3⤵
    - Program crash
    PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3504 -ip 3504
1⤵
PID:396

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0e766c64-c561-4fb3-875a-f719ae88510c.tmp

Filesize
6KB

MD5
93d71854c7712e9e00e675c406ace16b

SHA1
80bd9cbc359f6f16c690208632f97c64df7e9893

SHA256
e2a2131f373b43a883161aa72326b57b042c15d9c4fa01e0d89a695c96f64895

SHA512
1dcb624e1233e28587ed35266df98ee17c08a3de5e542d670f6e431ed540575287821d3c15c2f0fdd254c90b5f5e49bfab6bc67ffde50ebf7196d8be46c3c351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e91684ad6d7a77384ca3485f089f9a65

SHA1
fa72822320d63d2cfe3fb82b5e7a91e2b4d1cf4f

SHA256
537cda98153d15bfe34aee6cc4ae7974bc02b586ac427c6e02f6bb71c2362333

SHA512
37ae96e323f031b9c08fe9ab6a389bc69387e3d00c8c382115a25c9bee9d0a22b27193bdf0029832a7f112868b27acf99fbe96f99ccde95a2075cf0f207a7985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
45332f2668512ec960b2200428475219

SHA1
0a209af585646c6f34bd3cc9a54acd8da3156bf8

SHA256
bf4de1b226b155633c703b9aeaadf2eedbf348f1ed8de63dae21f756b6c29856

SHA512
7ec2b632367d04be367ea0697a706eebea24330d02a54cce8e5eb2d111864060cfdb4561b5a107d564d761d8a3a2d1f4e1998ebc429af4db768adeffc64092cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
76ce25dd0003895d216aec011fd48815

SHA1
82b7e4be21ebef67d9fe1b9b8025961da5a45f9a

SHA256
c0098c46f84c08915e00ce0dba99fc5c119a8b277d1525335207466a7ce2f9bb

SHA512
7926cd52bd8cb212c621ebee307fb85584c8f3b565daca95eaef7c8620b68d567334ab8da6b041ff975183fb984d73a84a5f0ae2b7a51c2a60a58a38cdb45f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
5b2d55db23bc2a600a28fd7d39bc8279

SHA1
9a4fd961388ede2b1379aa4dd327390d632217c4

SHA256
b5447ae1e2fbda390e64da26530afc8e7d9397782b21d5f19f781bcc4fcf207b

SHA512
1e7c90aec7f7ae8db2867f7e38f3b75058804a2c1e5244e4be678e165fa510f6d1c4226c555daa8add5a411cdbc56a0becb3fce301620785973c6a60935e5f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e13fd186af03d002d7a84470d37dfb56

SHA1
c9777e53acaa7c0ec8d994a2c5adbe5b1ffe6dd9

SHA256
ecfe25c5fd8228dff898754028ee0a17ad1dc4e72a09e0b9889d2cd3d0e2ec02

SHA512
b8e9733b50b6c0d6ff08d6b934f721e9e2dba5c24027726af5f01732c999ad80e16c99e31e4c90aa4a241f3b09011b9f7970c088885bccba44e81c9805e0e8b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbdbb0f614d8cbca8673b2e811ef2e5b

SHA1
16b950ff27fdd9793c059439fa6f3fc75843d3af

SHA256
6518282a21f345217489ea1322dace4f66af14361615d159edb8b6e3391ade80

SHA512
f110046181dd0d43029cd120961bde922c32bc15db972d1adb559006ce994cfaea8b15487f5ee1112c1400818b3ef068bf60663f41127cf478df5eb52cb765d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12fe2cf5a5b891c7aace0dc24cc923c3

SHA1
b298cc530f093d5c06d39ad8e6fab0d3ad19d3eb

SHA256
60ef34ba106e2b55237a4ae1eab4a2cc7985139ce56372d5b59e4cbab1f88a08

SHA512
3e603fac994caaf51e621ba66ba477a2c86d439a8aaa94bfd18a3a067e1cb2813994e834cd258e1c958258b6bbd74f249ee8ee7543b94549e62d0116fbe87a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
adaa80da890a2182623f6f1aca18cbea

SHA1
f534360a575a3749beda85722cc1d744133adfc3

SHA256
dcca9d81f861ff351222a77f21d8d550014d0c82b31931193135c29a0cf8e777

SHA512
ed25afe17145f6241167506fe1cf9c91d1b28fc834d872e305a6d8f750d62e814c96e673951af15f46a860f8eb97dd48009e1d6069dd692fed682105012b1d64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
4cff392cf0e6e7917ca9ab911ca1fdb1

SHA1
7fad596a73fce2f6d1cced249c9b1d054e363481

SHA256
be787f65a1f3d3eb872d2f500aa6b43e002854a930cf5b71b949dda030b44c84

SHA512
5bf033fe4e7a3000d50ecdaa5ce29c790499f7febf428c55fecefb248fb402664b1c368657fb254f4b4a193eeb2bdd2eb9274ea17d099211920286e3a5913384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
bcd12ad1c1aede2829fee72cea8ddfbf

SHA1
b27abbbf0aabcf4f8d0fca880c6c2d3a646ae630

SHA256
07df942f2db5ed261a8b946b557e3f1e62a58530b8eca6c0a2824c4c6e355344

SHA512
02644087f216fc39ee4bc72f3f1e15833b9a963453fabdfa3e594acdde2c821a2842ae0dcf535b8d44b12f751b291b9cb960edfecd4f46e776ab81bcd402776f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aba6be854c632946094fd943268b1b92

SHA1
b26ba86146fcb156c6afa4a349941d320b18d40d

SHA256
cdf3cd6783f114d546a603a7b31965647e4b95f4ed3ab4d74c96b6fd0fc035fe

SHA512
f606614e8138f9a3cef22f3d010af6fcea0b279a0f56ea5b44ef743844d0ba2c9426909cf720673985ddbc99de49073a5f8c7b7b19cf5c2874941c7ee1fd83b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
58c8df74de3fb632e7f8f5f666678838

SHA1
1588f5b7278da83cd12189ac7424bec115d42b0d

SHA256
b10923b33f967efb49da9471e42aa895f58de2ac80139c491cfbf3e2467f489c

SHA512
a26918fdd6684ff17c4aa60c697bfc1c47e00a66e04965bbf33c9c634300d48a721e9224072a6487a8be642477f48b3d7b816d671ef8adaffd7ce9edc6f1002f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bc34e8a398c8aefc1c6fa7d87b1516c1

SHA1
45e3d1cf296f9e56c5ac1cde82e069ce4b3c0e6f

SHA256
9bb34062ab384c9c2c373f5ced5d30ca20b8c94ac04758e991f46304b305107f

SHA512
2c0eea5e86648cd80dbd38d0cd79af630319400bca41f2d375ba7b3e63d13a96a0bf69009186d0629ba79f074f9385c7e1f781967e0f7ffba2dfb64281f3c32f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
7dee0112e422578c424c49cf396201af

SHA1
eb1d994b7d8428dc7b998aa601d7fba832752eca

SHA256
874cc24775c1b885b302a4f67c3f4f56a334186896e1886785dbf6cf45df2529

SHA512
1ed8d69f047a51f6acf8f23f3774aa3663061f8f2cbccc8e9928fefd77e339e7f5b508b7f4e813ba11229967a5adf33b1e5794838b0e4f513d088b52aa64c19d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586721.TMP

Filesize
874B

MD5
d0d6631ba141fe4b7aa7a9b1cdb05ee4

SHA1
92d2a5b35b237b12738baabf3058859894b7c0ad

SHA256
a6dae273246988353a1178ebf6762784abd9e0abd9058091f0c484a3100e24f8

SHA512
2c557f3b1ef21434baaa3e101b9d6f3b8b1ac7bd52bf684f34d4a5631876d1844611018ec35c960d9fa741be9bbdd50142d4c7b121351700dc72d45afe90be16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
789a7ba7c4eb31b4c9e06315a12cb485

SHA1
4945e6c0cbd625527c9ace6c462993d5b871c2f5

SHA256
931b3706cac0762a3e4f165c0e1291578ef7402be2eedfb16f6ce4583b2de91a

SHA512
7f85c2f60a6cdfeec2fcb06124c0df4603e70535e05181c11d1153c14b0ec8f944d800baa60804d3ebed0c34913e464a9925ee815bc5853f69acd51540056127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87205ff6f4d64180725b76587023b8d0

SHA1
64a2ccb151434e8de459021d55974a3bd5cb8f5d

SHA256
a994539d79f59cdde407b97ccd4762c97c1fb6598a841a3747c942e5c8666123

SHA512
f5a9d41426b8f167aa4e1a4c3143c454bbe675af6775f1341edd9cad75227ab182a222703c99733505a7982ef54981ab4ed7ed7ff796d38924425ed1ffa2a4ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5e6787b35c41d39d5d9668f417b79d4d

SHA1
a9b2aed5c0b00c0130601364cb4668d82ba74186

SHA256
b79c0de90190379ba01435d0a1ee4b4d8e5ebca3b9b3ee9f3e4dee498f23d9db

SHA512
a403d63dd67d06e9cb13a91889c508fbad43ccbfc1f7e4e127b2fc0bb6c045e80a118e753edef2a567177b397b8a939c129565f7e5db4c8f3094ef54c8df0807

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 715941.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
memory/440-445-0x0000000002250000-0x00000000024BB000-memory.dmp

Filesize
2.4MB

Download
memory/440-396-0x0000000002250000-0x00000000024BB000-memory.dmp

Filesize
2.4MB

Download
memory/440-403-0x0000000002250000-0x00000000024BB000-memory.dmp

Filesize
2.4MB

Download
memory/3504-397-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/4512-433-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download
memory/4512-437-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download
memory/4512-443-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download
memory/4512-442-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download
memory/4512-441-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download
memory/4512-440-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download
memory/4512-439-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download
memory/4512-438-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download
memory/4512-432-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download
memory/4512-431-0x0000011C90F90000-0x0000011C90F91000-memory.dmp

Filesize
4KB

Download