danabot | 8b5118ba1223c3aa351e6def9781aa38a8ee565c6103c9e8db9c0db392afc6f5

General

Target

f03124efa7dc4f6beb866a3a5f3e2896.exe
Size

2.6MB
MD5

f03124efa7dc4f6beb866a3a5f3e2896
SHA1

24f1afa8536fbed461af1e549152d6e677b6c9f7
SHA256

8b5118ba1223c3aa351e6def9781aa38a8ee565c6103c9e8db9c0db392afc6f5
SHA512

204c4e894c035261f1392f565c895cd28330e7790512b2cf3b814de80b9d32aa2043e5a84c7a1f02e552710961a9cc71f89eed228ca9850eee56abf739037f7e

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

38.68.50.140

38.68.50.172

172.241.27.92

45.135.167.14

37.120.145.180

95.174.65.203

185.227.138.47

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow	pid	process
3	1632	rundll32.exe
6	1632	rundll32.exe
7	1632	rundll32.exe
8	1632	rundll32.exe
9	1632	rundll32.exe
10	1632	rundll32.exe
11	1632	rundll32.exe
12	1632	rundll32.exe

Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1440 regsvr32.exe
1632 rundll32.exe
1632 rundll32.exe
1632 rundll32.exe
1632 rundll32.exe

pid	process
1440	regsvr32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f03124efa7dc4f6beb866a3a5f3e2896.exeregsvr32.exe

description	pid	process	target process
PID 1688 wrote to memory of 1440	1688	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 1688 wrote to memory of 1440	1688	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 1688 wrote to memory of 1440	1688	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 1688 wrote to memory of 1440	1688	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 1688 wrote to memory of 1440	1688	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 1688 wrote to memory of 1440	1688	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 1688 wrote to memory of 1440	1688	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 1440 wrote to memory of 1632	1440	regsvr32.exe	rundll32.exe
PID 1440 wrote to memory of 1632	1440	regsvr32.exe	rundll32.exe
PID 1440 wrote to memory of 1632	1440	regsvr32.exe	rundll32.exe
PID 1440 wrote to memory of 1632	1440	regsvr32.exe	rundll32.exe
PID 1440 wrote to memory of 1632	1440	regsvr32.exe	rundll32.exe
PID 1440 wrote to memory of 1632	1440	regsvr32.exe	rundll32.exe
PID 1440 wrote to memory of 1632	1440	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\f03124efa7dc4f6beb866a3a5f3e2896.exe
"C:\Users\Admin\AppData\Local\Temp\f03124efa7dc4f6beb866a3a5f3e2896.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\F03124~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\F03124~1.EXE@1688
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\F03124~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
memory/1440-2-0x0000000000000000-mapping.dmp

Download
memory/1632-5-0x0000000000000000-mapping.dmp

Download
memory/1688-0-0x0000000002180000-0x00000000023F7000-memory.dmp

Filesize
2.5MB

Download
memory/1688-1-0x0000000002400000-0x0000000002411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads