| download: | file32.exe |
| Full analysis: | https://app.any.run/tasks/e3e9a158-a08c-4fca-9db1-9f94d4cb713d |
| Verdict: | Malicious activity |
| Threats: | Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild, this is one of the most advanced thanks to the modular design and a complex delivery method. |
| Analysis date: | September 11, 2019, 00:18:31 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 273D942F836A3B6A30823A967B73F42E |
| SHA1: | 65B4D8A117D74796D9D6737B363A6F0E28E426A4 |
| SHA256: | 8E64E3CF269B87F4E6F0C634E50C1946259B6017D4A7E6FCF36A27CAFA0BA821 |
| SSDEEP: | 24576:rFbsLyjADERKMhp3KY8n+WZgMfGGD1qZ7HilX/T78PTGajiZeaEZB5QfFs41m:rFbskoCpMn5fbJqAl7IPT2BqMu41m |
MALICIOUS
Registers / Runs the DLL via REGSVR32.EXE
- file32.exe (PID: 3208)
Loads dropped or rewritten executable
- regsvr32.exe (PID: 3912)
- rundll32.exe (PID: 2676)
- rundll32.exe (PID: 2980)
- RUNDLL32.EXE (PID: 2348)
- RUNDLL32.EXE (PID: 3768)
- svchost.exe (PID: 2720)
- RUNDLL32.EXE (PID: 3896)
- RUNDLL32.EXE (PID: 4056)
- winlogon.exe (PID: 444)
- services.exe (PID: 492)
- explorer.exe (PID: 276)
- RUNDLL32.EXE (PID: 2732)
Connects to CnC server
- rundll32.exe (PID: 2676)
DANABOT was detected
- rundll32.exe (PID: 2676)
DanaBot detected
- rundll32.exe (PID: 2980)
- RUNDLL32.EXE (PID: 2348)
- RUNDLL32.EXE (PID: 3768)
- winlogon.exe (PID: 444)
- svchost.exe (PID: 2720)
- RUNDLL32.EXE (PID: 3896)
- RUNDLL32.EXE (PID: 4056)
- explorer.exe (PID: 276)
- RUNDLL32.EXE (PID: 2732)
- services.exe (PID: 492)
Runs injected code in another process
- svchost.exe (PID: 2720)
Application was injected by another process
- winlogon.exe (PID: 444)
- services.exe (PID: 492)
- explorer.exe (PID: 276)
Stealing of credential data
- RUNDLL32.EXE (PID: 2348)
Actions looks like stealing of personal data
- RUNDLL32.EXE (PID: 2348)
Changes settings of System certificates
- RUNDLL32.EXE (PID: 4056)
SUSPICIOUS
Uses RUNDLL32.EXE to load library
- regsvr32.exe (PID: 3912)
- rundll32.exe (PID: 2676)
- rundll32.exe (PID: 2980)
- svchost.exe (PID: 2720)
Executable content was dropped or overwritten
- file32.exe (PID: 3208)
- rundll32.exe (PID: 2676)
Creates files in the program directory
- rundll32.exe (PID: 2676)
- rundll32.exe (PID: 2980)
- svchost.exe (PID: 2720)
- RUNDLL32.EXE (PID: 4056)
- RUNDLL32.EXE (PID: 2348)
Application launched itself
- rundll32.exe (PID: 2676)
- rundll32.exe (PID: 2980)
Searches for installed software
- RUNDLL32.EXE (PID: 2348)
Creates or modifies windows services
- services.exe (PID: 492)
- RUNDLL32.EXE (PID: 3768)
Loads DLL from Mozilla Firefox
- RUNDLL32.EXE (PID: 2348)
- RUNDLL32.EXE (PID: 4056)
- RUNDLL32.EXE (PID: 2732)
Reads Windows Product ID
- RUNDLL32.EXE (PID: 2348)
Creates files in the user directory
- RUNDLL32.EXE (PID: 4056)
Reads the cookies of Google Chrome
- RUNDLL32.EXE (PID: 2348)
Reads the cookies of Mozilla Firefox
- RUNDLL32.EXE (PID: 2348)
INFO
Application was crashed
- file32.exe (PID: 3208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2016:04:16 13:22:44+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 172032 |
| InitializedDataSize: | 134656 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x15a63 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.1 |
| ProductVersionNumber: | 1.0.0.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Faith LTD |
| FileDescription: | Faith Versioning System Client |
| FileVersion: | 1, 0, 0, 1 |
| InternalName: | CWebUpdatePrj |
| LegalCopyright: | Copyright (C) 2013 Faith LTD |
| OriginalFileName: | faithversion.exe |
| ProductName: | Faith Versioning System |
| ProductVersion: | 1, 0, 0, 1 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 16-Apr-2016 11:22:44 |
| Detected languages: |
|
| CompanyName: | Faith LTD |
| FileDescription: | Faith Versioning System Client |
| FileVersion: | 1, 0, 0, 1 |
| InternalName: | CWebUpdatePrj |
| LegalCopyright: | Copyright (C) 2013 Faith LTD |
| OriginalFilename: | faithversion.exe |
| ProductName: | Faith Versioning System |
| ProductVersion: | 1, 0, 0, 1 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000F0 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 4 |
| Time date stamp: | 16-Apr-2016 11:22:44 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x00029E5F | 0x0002A000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.59724 |
.data | 0x0002B000 | 0x0001619A | 0x00016200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.70428 |
.rsrc | 0x00042000 | 0x0000AA2C | 0x0000AC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.2696 |
.lord | 0x0004D000 | 0x0012C01F | 0x0012C200 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.98167 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.79597 | 346 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 2.93439 | 488 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
3 | 2.7332 | 296 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
4 | 3.87474 | 2216 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
5 | 3.43145 | 1736 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
6 | 2.46548 | 1384 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
7 | 3.63552 | 4264 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
8 | 4.46144 | 2440 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
9 | 4.4314 | 1128 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
10 | 4.77578 | 2216 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
Imports
ADVAPI32.dll |
COMCTL32.dll |
COMDLG32.dll |
GDI32.dll |
KERNEL32.dll |
OLEACC.dll |
OLEAUT32.dll |
SHLWAPI.dll |
USER32.dll |
WINSPOOL.DRV |
Total processes
48
Monitored processes
15
Malicious processes
13
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 276 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 444 | winlogon.exe | C:\Windows\System32\winlogon.exe | — | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Logon Application Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 492 | C:\Windows\system32\services.exe | C:\Windows\System32\services.exe | wininit.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Services and Controller app Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2348 | C:\Windows\system32\RUNDLL32.EXE C:\ProgramData\CD7092AF\F78E05D4.dll,f2 F7090F619059A3FEB3E71D0ADA462372 | C:\Windows\system32\RUNDLL32.EXE | rundll32.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2676 | C:\Windows\system32\\rundll32.exe C:\Users\admin\AppData\Local\Temp\file32.dll,f0 | C:\Windows\system32\rundll32.exe | regsvr32.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2720 | C:\Windows\system32\svchost.exe -k LocalService | C:\Windows\system32\svchost.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2732 | C:\Windows\system32\RUNDLL32.EXE C:\ProgramData\CD7092AF\F78E05D4.dll,f2 E48E292D52741264BCBA6B30A9CB2113 | C:\Windows\system32\RUNDLL32.EXE | svchost.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2980 | C:\Windows\system32\\rundll32.exe C:\PROGRA~2\CD7092AF\F78E05D4.dll,f1 C:\Users\admin\AppData\Local\Temp\file32.dll@2676 | C:\Windows\system32\rundll32.exe | rundll32.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3208 | "C:\Users\admin\AppData\Local\Temp\file32.exe" | C:\Users\admin\AppData\Local\Temp\file32.exe | explorer.exe | ||||||||||||
User: admin Company: Faith LTD Integrity Level: MEDIUM Description: Faith Versioning System Client Exit code: 3221225477 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
| 3216 | "C:\Windows\System32\wusa.exe" /quiet | C:\Windows\System32\wusa.exe | rundll32.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Update Standalone Installer Exit code: 87 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
371
Read events
308
Write events
63
Delete events
0
Modification events
| (PID) Process: | (2980) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2980) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2348) RUNDLL32.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RUNDLL32_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2348) RUNDLL32.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RUNDLL32_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2348) RUNDLL32.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RUNDLL32_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2348) RUNDLL32.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RUNDLL32_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2348) RUNDLL32.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RUNDLL32_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (2348) RUNDLL32.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RUNDLL32_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (3768) RUNDLL32.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost |
| Operation: | write | Name: | LocalService |
Value: CD7092AF | |||
| (PID) Process: | (3768) RUNDLL32.EXE | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CD7092AF |
| Operation: | write | Name: | Description |
Value: @%SystemRoot%\system32\Sens.dll,-201 | |||
Executable files
2
Suspicious files
3
Text files
3
Unknown types
15
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2676 | rundll32.exe | C:\ProgramData\CD7092AF\88C0025B | — | |
MD5:— | SHA256:— | |||
| 2348 | RUNDLL32.EXE | C:\Users\admin\AppData\Local\Temp\1558250.tmp-shm | — | |
MD5:— | SHA256:— | |||
| 4056 | RUNDLL32.EXE | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal | — | |
MD5:— | SHA256:— | |||
| 4056 | RUNDLL32.EXE | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db-journal | — | |
MD5:— | SHA256:— | |||
| 2348 | RUNDLL32.EXE | C:\Users\admin\AppData\Local\Temp\1562421.tmp | — | |
MD5:— | SHA256:— | |||
| 2348 | RUNDLL32.EXE | C:\Users\admin\AppData\Local\Temp\1562421.tmp-shm | — | |
MD5:— | SHA256:— | |||
| 2980 | rundll32.exe | C:\ProgramData\CD7092AF\3E73D36A | text | |
MD5:— | SHA256:— | |||
| 3208 | file32.exe | C:\Users\admin\AppData\Local\Temp\file32.dll | executable | |
MD5:— | SHA256:— | |||
| 2720 | svchost.exe | C:\ProgramData\CD7092AF\45E29FAD\65F715BB40AC771809D92DBC951CCB3A.zip | — | |
MD5:— | SHA256:— | |||
| 2720 | svchost.exe | C:\ProgramData\CD7092AF\3E73D36A | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
15
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2676 | rundll32.exe | 105.220.72.181:443 | — | TICSA-ASN | ZA | malicious |
2676 | rundll32.exe | 5.45.65.74:443 | — | Serverius Holding B.V. | NL | malicious |
DNS requests
Threats
PID | Process | Class | Message |
|---|---|---|---|
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
2676 | rundll32.exe | A Network Trojan was detected | MALWARE [PTsecurity] Win32/Spy.Danabot.I |
1 ETPRO signatures available at the full report