Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    155s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    04/01/2025, 01:04

General

  • Target

    The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe

  • Size

    2.7MB

  • MD5

    48d8f7bbb500af66baa765279ce58045

  • SHA1

    2cdb5fdeee4e9c7bd2e5f744150521963487eb71

  • SHA256

    db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

  • SHA512

    aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

  • SSDEEP

    49152:bbevayZlMTWkygVy0nQZfVY2BtZzpPL4PuQ65+6Dv7m0KXTn:bbexZlMQcEVY2BtZzpPL4WQI9U

Malware Config

Extracted

Family

danabot

C2

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot family
  • Danabot x86 payload 1 IoCs

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

  • Blocklisted process makes network request 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe
    "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:712
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\THE-MA~1\BANKIN~1\DanaBot.dll f1 C:\Users\Admin\AppData\Local\Temp\THE-MA~1\BANKIN~1\DanaBot.exe@712
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\THE-MA~1\BANKIN~1\DanaBot.dll,f0
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 468
      2⤵
      • Program crash
      PID:4256
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 712 -ip 712
    1⤵
      PID:4848
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=5064,i,17437436182398955805,1059754208013914332,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
      1⤵
        PID:4856

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\THE-MA~1\BANKIN~1\DanaBot.dll

        Filesize

        2.4MB

        MD5

        7e76f7a5c55a5bc5f5e2d7a9e886782b

        SHA1

        fc500153dba682e53776bef53123086f00c0e041

        SHA256

        abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

        SHA512

        0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

      • memory/712-1-0x00000000026A0000-0x0000000002920000-memory.dmp

        Filesize

        2.5MB

      • memory/712-2-0x0000000002920000-0x0000000002BAD000-memory.dmp

        Filesize

        2.6MB

      • memory/712-3-0x0000000000400000-0x000000000069A000-memory.dmp

        Filesize

        2.6MB

      • memory/712-11-0x0000000000400000-0x0000000000AAD000-memory.dmp

        Filesize

        6.7MB

      • memory/712-13-0x0000000000400000-0x000000000069A000-memory.dmp

        Filesize

        2.6MB

      • memory/712-12-0x0000000002920000-0x0000000002BAD000-memory.dmp

        Filesize

        2.6MB

      • memory/1144-14-0x0000000000400000-0x000000000066B000-memory.dmp

        Filesize

        2.4MB

      • memory/1144-16-0x0000000000400000-0x000000000066B000-memory.dmp

        Filesize

        2.4MB

      • memory/1984-8-0x0000000002110000-0x000000000237B000-memory.dmp

        Filesize

        2.4MB

      • memory/1984-9-0x00000000020C0000-0x00000000020C1000-memory.dmp

        Filesize

        4KB