danabot | ed22f2dca8b71427cc4b0f0124fb4bcbe7790e83a3617a596befc79e5040c92a

General

Target

SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe
Size

2.6MB
MD5

cc71bdb3d4b7d7ee07e7a930604ec05e
SHA1

bc9df0208c08ace9a910fbe8507bba1ab1588b5d
SHA256

ed22f2dca8b71427cc4b0f0124fb4bcbe7790e83a3617a596befc79e5040c92a
SHA512

0939eab2fbf98d2b5186ecfba3297debbcf37a57ac0dc319078d7a36fa73f6b6e81b357c8f8dc816974327051c7d36fda7bc4b217edd563f0ce923772eb347e7

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

92.204.160.126

193.34.166.26

93.115.22.159

93.115.22.165

185.227.138.52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 5 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2968 created 3840 2968 WerFault.exe SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe

description	pid	process	target process
PID 2968 created 3840	2968	WerFault.exe	SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
4	1980	rundll32.exe
7	1980	rundll32.exe
8	1980	rundll32.exe
9	1980	rundll32.exe
10	1980	rundll32.exe
11	1980	rundll32.exe
12	1980	rundll32.exe
13	1980	rundll32.exe
14	1980	rundll32.exe
17	1980	rundll32.exe

Loads dropped DLL 4 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3392 regsvr32.exe
3392 regsvr32.exe
1980 rundll32.exe
1980 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2968 3840 WerFault.exe SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe

pid	process
3392	regsvr32.exe
3392	regsvr32.exe
1980	rundll32.exe
1980	rundll32.exe

pid	pid_target	process	target process
2968	3840	WerFault.exe	SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2968 WerFault.exe
Token: SeBackupPrivilege 2968 WerFault.exe
Token: SeDebugPrivilege 2968 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2968	WerFault.exe
Token: SeBackupPrivilege	2968	WerFault.exe
Token: SeDebugPrivilege	2968	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exeregsvr32.exe

description	pid	process	target process
PID 3840 wrote to memory of 3392	3840	SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe	regsvr32.exe
PID 3840 wrote to memory of 3392	3840	SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe	regsvr32.exe
PID 3840 wrote to memory of 3392	3840	SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe	regsvr32.exe
PID 3392 wrote to memory of 1980	3392	regsvr32.exe	rundll32.exe
PID 3392 wrote to memory of 1980	3392	regsvr32.exe	rundll32.exe
PID 3392 wrote to memory of 1980	3392	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.cc71bdb3d4b7d7ee.16690.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3840

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@3840
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3392

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 396
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
memory/1980-9-0x0000000000000000-mapping.dmp

Download
memory/2968-6-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/2968-7-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/2968-12-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/3392-2-0x0000000000000000-mapping.dmp

Download
memory/3840-1-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads