danabot | 2aa79c5cfd9e657abd3eea42ddc3b31d44123e4fd14be4d4bcd7057b036c169b

General

Target

SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe
Size

2.6MB
MD5

4a1c3c28361ddbf3bb561482fac48a13
SHA1

c68d711aa133dab19ca4e8a0b75b6a9230d7b8e6
SHA256

2aa79c5cfd9e657abd3eea42ddc3b31d44123e4fd14be4d4bcd7057b036c169b
SHA512

c40de41edac45124e65fb246a92db686c8e4f8a7c6e0b3f04215ac63f1ee40dccaad74d179289f0ca019c4b4b0b0d0b60a1c3ac0f80dab59c8c0856bf661bb43

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

92.204.160.126

193.34.166.26

93.115.22.159

93.115.22.165

185.227.138.52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
1	1432	rundll32.exe
2	1432	rundll32.exe
3	1432	rundll32.exe
4	1432	rundll32.exe
5	1432	rundll32.exe
7	1432	rundll32.exe
8	1432	rundll32.exe
9	1432	rundll32.exe
10	1432	rundll32.exe
11	1432	rundll32.exe

Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1328 regsvr32.exe
1432 rundll32.exe
1432 rundll32.exe
1432 rundll32.exe
1432 rundll32.exe

pid	process
1328	regsvr32.exe
1432	rundll32.exe
1432	rundll32.exe
1432	rundll32.exe
1432	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exeregsvr32.exe

description	pid	process	target process
PID 1124 wrote to memory of 1328	1124	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe	regsvr32.exe
PID 1124 wrote to memory of 1328	1124	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe	regsvr32.exe
PID 1124 wrote to memory of 1328	1124	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe	regsvr32.exe
PID 1124 wrote to memory of 1328	1124	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe	regsvr32.exe
PID 1124 wrote to memory of 1328	1124	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe	regsvr32.exe
PID 1124 wrote to memory of 1328	1124	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe	regsvr32.exe
PID 1124 wrote to memory of 1328	1124	SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe	regsvr32.exe
PID 1328 wrote to memory of 1432	1328	regsvr32.exe	rundll32.exe
PID 1328 wrote to memory of 1432	1328	regsvr32.exe	rundll32.exe
PID 1328 wrote to memory of 1432	1328	regsvr32.exe	rundll32.exe
PID 1328 wrote to memory of 1432	1328	regsvr32.exe	rundll32.exe
PID 1328 wrote to memory of 1432	1328	regsvr32.exe	rundll32.exe
PID 1328 wrote to memory of 1432	1328	regsvr32.exe	rundll32.exe
PID 1328 wrote to memory of 1432	1328	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@1124
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
17a152a9c199508bc77e67f0dcacf6b9

SHA1
dffb7313156364818b857ed1e7837222007dd389

SHA256
affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f

SHA512
64c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
17a152a9c199508bc77e67f0dcacf6b9

SHA1
dffb7313156364818b857ed1e7837222007dd389

SHA256
affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f

SHA512
64c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
17a152a9c199508bc77e67f0dcacf6b9

SHA1
dffb7313156364818b857ed1e7837222007dd389

SHA256
affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f

SHA512
64c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
17a152a9c199508bc77e67f0dcacf6b9

SHA1
dffb7313156364818b857ed1e7837222007dd389

SHA256
affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f

SHA512
64c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
17a152a9c199508bc77e67f0dcacf6b9

SHA1
dffb7313156364818b857ed1e7837222007dd389

SHA256
affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f

SHA512
64c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
17a152a9c199508bc77e67f0dcacf6b9

SHA1
dffb7313156364818b857ed1e7837222007dd389

SHA256
affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f

SHA512
64c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc

Download Submit
memory/1124-0-0x0000000004F70000-0x00000000051E7000-memory.dmp

Filesize
2.5MB

Download
memory/1124-1-0x00000000051F0000-0x0000000005201000-memory.dmp

Filesize
68KB

Download
memory/1328-2-0x0000000000000000-mapping.dmp

Download
memory/1432-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads