danabot | b7aaf5ad482d87c9d03c2d33d9757cc6c675091e54b8f253406a53c4d0ac157c

General

Target

2e63e9d30b26db39bd24c66b385b48cb.exe
Size

2.7MB
MD5

2e63e9d30b26db39bd24c66b385b48cb
SHA1

410a7bd32b78f8b501c8049e01ae0754d1d27086
SHA256

b7aaf5ad482d87c9d03c2d33d9757cc6c675091e54b8f253406a53c4d0ac157c
SHA512

f2a6e76923fc1eec240af9efcbcc59d2b1b6adb10483f5ad587cbecab5628217f65d7d51a7659faf604bc928f468d459695a843839da71d55561e0edce86f4ab

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

179.43.133.50

193.34.166.141

23.108.57.107

185.227.138.47

104.168.213.174

23.106.123.48

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 5 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL	family_danabot

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
10	2716	rundll32.exe
16	2716	rundll32.exe
18	2716	rundll32.exe
21	2716	rundll32.exe
22	2716	rundll32.exe
23	2716	rundll32.exe
24	2716	rundll32.exe
25	2716	rundll32.exe
26	2716	rundll32.exe
29	2716	rundll32.exe

Loads dropped DLL 4 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3328 regsvr32.exe
3328 regsvr32.exe
2716 rundll32.exe
2716 rundll32.exe

pid	process
3328	regsvr32.exe
3328	regsvr32.exe
2716	rundll32.exe
2716	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2e63e9d30b26db39bd24c66b385b48cb.exeregsvr32.exe

description	pid	process	target process
PID 984 wrote to memory of 3328	984	2e63e9d30b26db39bd24c66b385b48cb.exe	regsvr32.exe
PID 984 wrote to memory of 3328	984	2e63e9d30b26db39bd24c66b385b48cb.exe	regsvr32.exe
PID 984 wrote to memory of 3328	984	2e63e9d30b26db39bd24c66b385b48cb.exe	regsvr32.exe
PID 3328 wrote to memory of 2716	3328	regsvr32.exe	rundll32.exe
PID 3328 wrote to memory of 2716	3328	regsvr32.exe	rundll32.exe
PID 3328 wrote to memory of 2716	3328	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\2e63e9d30b26db39bd24c66b385b48cb.exe
"C:\Users\Admin\AppData\Local\Temp\2e63e9d30b26db39bd24c66b385b48cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\2E63E9~1.EXE@984
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3328

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL
MD5
7536393df88516884b32bddb1105f951

SHA1
b7d94e0d82b5bccf56d9861e7af67713317d8d8a

SHA256
4aba280f185d15f05f0bcda68a825be1bfeec8ef27385982b65708fedcd3e779

SHA512
8b1405e733c77e849adbc501f6c11fe2cd9096ad0e4029337033e15862377ed8a0b8f84712ee1df1d1471e95f83d701d7cf1794a401a5837066f77a1f269dd4a

Download Submit
\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL
MD5
7536393df88516884b32bddb1105f951

SHA1
b7d94e0d82b5bccf56d9861e7af67713317d8d8a

SHA256
4aba280f185d15f05f0bcda68a825be1bfeec8ef27385982b65708fedcd3e779

SHA512
8b1405e733c77e849adbc501f6c11fe2cd9096ad0e4029337033e15862377ed8a0b8f84712ee1df1d1471e95f83d701d7cf1794a401a5837066f77a1f269dd4a

Download Submit
\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL
MD5
7536393df88516884b32bddb1105f951

SHA1
b7d94e0d82b5bccf56d9861e7af67713317d8d8a

SHA256
4aba280f185d15f05f0bcda68a825be1bfeec8ef27385982b65708fedcd3e779

SHA512
8b1405e733c77e849adbc501f6c11fe2cd9096ad0e4029337033e15862377ed8a0b8f84712ee1df1d1471e95f83d701d7cf1794a401a5837066f77a1f269dd4a

Download Submit
\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL
MD5
7536393df88516884b32bddb1105f951

SHA1
b7d94e0d82b5bccf56d9861e7af67713317d8d8a

SHA256
4aba280f185d15f05f0bcda68a825be1bfeec8ef27385982b65708fedcd3e779

SHA512
8b1405e733c77e849adbc501f6c11fe2cd9096ad0e4029337033e15862377ed8a0b8f84712ee1df1d1471e95f83d701d7cf1794a401a5837066f77a1f269dd4a

Download Submit
\Users\Admin\AppData\Local\Temp\2E63E9~1.DLL
MD5
7536393df88516884b32bddb1105f951

SHA1
b7d94e0d82b5bccf56d9861e7af67713317d8d8a

SHA256
4aba280f185d15f05f0bcda68a825be1bfeec8ef27385982b65708fedcd3e779

SHA512
8b1405e733c77e849adbc501f6c11fe2cd9096ad0e4029337033e15862377ed8a0b8f84712ee1df1d1471e95f83d701d7cf1794a401a5837066f77a1f269dd4a

Download Submit
memory/984-1-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/2716-6-0x0000000000000000-mapping.dmp

Download
memory/3328-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads