danabot | 8b5118ba1223c3aa351e6def9781aa38a8ee565c6103c9e8db9c0db392afc6f5

General

Target

f03124efa7dc4f6beb866a3a5f3e2896.exe
Size

2.6MB
MD5

f03124efa7dc4f6beb866a3a5f3e2896
SHA1

24f1afa8536fbed461af1e549152d6e677b6c9f7
SHA256

8b5118ba1223c3aa351e6def9781aa38a8ee565c6103c9e8db9c0db392afc6f5
SHA512

204c4e894c035261f1392f565c895cd28330e7790512b2cf3b814de80b9d32aa2043e5a84c7a1f02e552710961a9cc71f89eed228ca9850eee56abf739037f7e

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

38.68.50.140

38.68.50.172

172.241.27.92

45.135.167.14

37.120.145.180

95.174.65.203

185.227.138.47

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F03124~1.DLL	family_danabot

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow	pid	process
10	2608	rundll32.exe
14	2608	rundll32.exe
15	2608	rundll32.exe
18	2608	rundll32.exe
19	2608	rundll32.exe
21	2608	rundll32.exe
24	2608	rundll32.exe
25	2608	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3596 regsvr32.exe
3596 regsvr32.exe
2608 rundll32.exe

pid	process
3596	regsvr32.exe
3596	regsvr32.exe
2608	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f03124efa7dc4f6beb866a3a5f3e2896.exeregsvr32.exe

description	pid	process	target process
PID 2268 wrote to memory of 3596	2268	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 2268 wrote to memory of 3596	2268	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 2268 wrote to memory of 3596	2268	f03124efa7dc4f6beb866a3a5f3e2896.exe	regsvr32.exe
PID 3596 wrote to memory of 2608	3596	regsvr32.exe	rundll32.exe
PID 3596 wrote to memory of 2608	3596	regsvr32.exe	rundll32.exe
PID 3596 wrote to memory of 2608	3596	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\f03124efa7dc4f6beb866a3a5f3e2896.exe
"C:\Users\Admin\AppData\Local\Temp\f03124efa7dc4f6beb866a3a5f3e2896.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\F03124~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\F03124~1.EXE@2268
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3596

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\F03124~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
\Users\Admin\AppData\Local\Temp\F03124~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
memory/2268-1-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/2608-6-0x0000000000000000-mapping.dmp

Download
memory/3596-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads