danabot | a31934ff6fce423c793ab9d1e4bd4067986033e552ba36a7ea360dec57b83dd2

General

Target

SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe
Size

2.6MB
MD5

3aca8b56716ae3d03be877b9dd4729a6
SHA1

fc0a13a5f18cb1b81a5ea67533a366ffceeda02b
SHA256

a31934ff6fce423c793ab9d1e4bd4067986033e552ba36a7ea360dec57b83dd2
SHA512

dfc89beca5485f96fa469b6985c69f402d5ca802a51e3218b862925cea747815642bdfcd899911d9542e38ee76483ce068a884164627403d150b7a21b3132117

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

92.204.160.126

193.34.166.26

93.115.22.159

93.115.22.165

185.227.138.52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 420 created 3008 420 WerFault.exe SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe

description	pid	process	target process
PID 420 created 3008	420	WerFault.exe	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
3	1652	rundll32.exe
9	1652	rundll32.exe
10	1652	rundll32.exe
13	1652	rundll32.exe
14	1652	rundll32.exe
15	1652	rundll32.exe
16	1652	rundll32.exe
17	1652	rundll32.exe
18	1652	rundll32.exe
19	1652	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1976 regsvr32.exe
1652 rundll32.exe
1652 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

420 3008 WerFault.exe SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe

pid	process
1976	regsvr32.exe
1652	rundll32.exe
1652	rundll32.exe

pid	pid_target	process	target process
420	3008	WerFault.exe	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 420 WerFault.exe
Token: SeBackupPrivilege 420 WerFault.exe
Token: SeDebugPrivilege 420 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	420	WerFault.exe
Token: SeBackupPrivilege	420	WerFault.exe
Token: SeDebugPrivilege	420	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exeregsvr32.exe

description	pid	process	target process
PID 3008 wrote to memory of 1976	3008	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe	regsvr32.exe
PID 3008 wrote to memory of 1976	3008	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe	regsvr32.exe
PID 3008 wrote to memory of 1976	3008	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe	regsvr32.exe
PID 1976 wrote to memory of 1652	1976	regsvr32.exe	rundll32.exe
PID 1976 wrote to memory of 1652	1976	regsvr32.exe	rundll32.exe
PID 1976 wrote to memory of 1652	1976	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@3008
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 392
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
memory/420-3-0x0000000004590000-0x0000000004591000-memory.dmp

Filesize
4KB

Download
memory/420-4-0x0000000004590000-0x0000000004591000-memory.dmp

Filesize
4KB

Download
memory/420-11-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/1652-8-0x0000000000000000-mapping.dmp

Download
memory/1976-2-0x0000000000000000-mapping.dmp

Download
memory/3008-1-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads