danabot | 4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec7506c2b6460df44c18e61d39d5b1c0.exe
Size 2.6MB
Sample201109-35m4lfb6ds
SHA256 4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d
MD5 ec7506c2b6460df44c18e61d39d5b1c0
SHA1 7c3e46cd7c93f3d9d783888f04f1607f6e487783
SHA512 cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e
MD5 SHA1 SHA512

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

92.204.160.54
2.56.213.179
45.153.186.47
93.115.21.29
185.45.193.50
193.34.166.247

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x00040000000130cc-3.dat	family_danabot
behavioral1/files/0x00040000000130cc-4.dat	family_danabot
behavioral1/files/0x00040000000130cc-6.dat	family_danabot
behavioral1/files/0x00040000000130cc-8.dat	family_danabot
behavioral1/files/0x00040000000130cc-7.dat	family_danabot
behavioral1/files/0x00040000000130cc-9.dat	family_danabot

Blocklisted process makes network request 8 IoCs

flow	pid	Process
5	1528	rundll32.exe
6	1528	rundll32.exe
9	1528	rundll32.exe
10	1528	rundll32.exe
11	1528	rundll32.exe
12	1528	rundll32.exe
13	1528	rundll32.exe
14	1528	rundll32.exe

Loads dropped DLL 5 IoCs

pid	Process
1084	regsvr32.exe
1528	rundll32.exe
1528	rundll32.exe
1528	rundll32.exe
1528	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1084	1704	ec7506c2b6460df44c18e61d39d5b1c0.exe	30
PID 1704 wrote to memory of 1084	1704	ec7506c2b6460df44c18e61d39d5b1c0.exe	30
PID 1704 wrote to memory of 1084	1704	ec7506c2b6460df44c18e61d39d5b1c0.exe	30
PID 1704 wrote to memory of 1084	1704	ec7506c2b6460df44c18e61d39d5b1c0.exe	30
PID 1704 wrote to memory of 1084	1704	ec7506c2b6460df44c18e61d39d5b1c0.exe	30
PID 1704 wrote to memory of 1084	1704	ec7506c2b6460df44c18e61d39d5b1c0.exe	30
PID 1704 wrote to memory of 1084	1704	ec7506c2b6460df44c18e61d39d5b1c0.exe	30
PID 1084 wrote to memory of 1528	1084	regsvr32.exe	31
PID 1084 wrote to memory of 1528	1084	regsvr32.exe	31
PID 1084 wrote to memory of 1528	1084	regsvr32.exe	31
PID 1084 wrote to memory of 1528	1084	regsvr32.exe	31
PID 1084 wrote to memory of 1528	1084	regsvr32.exe	31
PID 1084 wrote to memory of 1528	1084	regsvr32.exe	31
PID 1084 wrote to memory of 1528	1084	regsvr32.exe	31

C:\Users\Admin\AppData\Local\Temp\ec7506c2b6460df44c18e61d39d5b1c0.exe
"C:\Users\Admin\AppData\Local\Temp\ec7506c2b6460df44c18e61d39d5b1c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\EC7506~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\EC7506~1.EXE@1704
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\EC7506~1.DLL,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x00000000031B0000-0x0000000003427000-memory.dmp

Download

memory/1704-1-0x0000000003430000-0x0000000003441000-memory.dmp