danabot | a13c95a98b340edd7eeeff2da8272761cd84d093f43888e5940451d02b1a2dc0

General

Target

2d673fcd210cfad92825862e017eaa09.exe
Size

2.8MB
MD5

2d673fcd210cfad92825862e017eaa09
SHA1

531ac29cd36abba042f352983d9fcde29a987473
SHA256

a13c95a98b340edd7eeeff2da8272761cd84d093f43888e5940451d02b1a2dc0
SHA512

bac7a6decd497e06f4670b8439f830c9dbfdcfb5f9862f0304792f88748a6ebbf64d00c13ca512f85887c9f5608249b7bb642da1ff8c6d324400bacd86d741b0

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

37.120.145.180

95.174.65.203

51.77.7.204

192.236.160.191

193.34.167.174

185.227.138.47

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 3 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2D673F~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL	family_danabot

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
17	1760	rundll32.exe
21	1760	rundll32.exe
22	1760	rundll32.exe
23	1760	rundll32.exe
24	1760	rundll32.exe
25	1760	rundll32.exe
26	1760	rundll32.exe
27	1760	rundll32.exe
28	1760	rundll32.exe
30	1760	rundll32.exe

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

188 regsvr32.exe
1760 rundll32.exe

pid	process
188	regsvr32.exe
1760	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2d673fcd210cfad92825862e017eaa09.exeregsvr32.exe

description	pid	process	target process
PID 656 wrote to memory of 188	656	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 656 wrote to memory of 188	656	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 656 wrote to memory of 188	656	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 188 wrote to memory of 1760	188	regsvr32.exe	rundll32.exe
PID 188 wrote to memory of 1760	188	regsvr32.exe	rundll32.exe
PID 188 wrote to memory of 1760	188	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\2d673fcd210cfad92825862e017eaa09.exe
"C:\Users\Admin\AppData\Local\Temp\2d673fcd210cfad92825862e017eaa09.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\2D673F~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\2D673F~1.EXE@656
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:188

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2D673F~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2D673F~1.DLL
MD5
0b5c6715bbd0f63a32612de80cfa5e2b

SHA1
8403145be812a364249266e6edcb71afdf6f1d1c

SHA256
b0b546c795135265f843f8d5ae7b64f4b31c095fc9d4df48a026587cb400b641

SHA512
888b87b3704c015ea6878891964e9d21fd6a600f8e0f1e13a542ea2bfa542d1ef084b4624dfd1921f59be070bfc39f64fe4b04e8ea6922455e4d6ee90f67dc35

Download Submit
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL
MD5
0b5c6715bbd0f63a32612de80cfa5e2b

SHA1
8403145be812a364249266e6edcb71afdf6f1d1c

SHA256
b0b546c795135265f843f8d5ae7b64f4b31c095fc9d4df48a026587cb400b641

SHA512
888b87b3704c015ea6878891964e9d21fd6a600f8e0f1e13a542ea2bfa542d1ef084b4624dfd1921f59be070bfc39f64fe4b04e8ea6922455e4d6ee90f67dc35

Download Submit
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL
MD5
0b5c6715bbd0f63a32612de80cfa5e2b

SHA1
8403145be812a364249266e6edcb71afdf6f1d1c

SHA256
b0b546c795135265f843f8d5ae7b64f4b31c095fc9d4df48a026587cb400b641

SHA512
888b87b3704c015ea6878891964e9d21fd6a600f8e0f1e13a542ea2bfa542d1ef084b4624dfd1921f59be070bfc39f64fe4b04e8ea6922455e4d6ee90f67dc35

Download Submit
memory/188-2-0x0000000000000000-mapping.dmp

Download
memory/656-1-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1760-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads