danabot | 46c14ac886a864d3ff77606286c4ce983a060d57bcd07881ab299b1848918af5

General

Target

3bad137a2d5d20084fcf3fabf213ec08.exe
Size

1.0MB
MD5

3bad137a2d5d20084fcf3fabf213ec08
SHA1

079a6f24108c97a32923369b9e0e348c39bbf5dd
SHA256

46c14ac886a864d3ff77606286c4ce983a060d57bcd07881ab299b1848918af5
SHA512

475caf00146c93795752f0771cccee342edb17f5bdd9a778b885a7e34bf97b10b2569065093984cfb716033a3943b0f7681b9fcc80d5ffb973f19d70b6191b03

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

2.56.213.39

185.238.168.83

185.238.168.174

93.115.20.189

93.115.20.183

5.61.58.130

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

2 1432 rundll32.exe
3 1432 rundll32.exe
6 1432 rundll32.exe
7 1432 rundll32.exe
8 1432 rundll32.exe
9 1432 rundll32.exe
12 1432 rundll32.exe
Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1536 regsvr32.exe
1432 rundll32.exe
1432 rundll32.exe
1432 rundll32.exe
1432 rundll32.exe

flow	pid	process
2	1432	rundll32.exe
3	1432	rundll32.exe
6	1432	rundll32.exe
7	1432	rundll32.exe
8	1432	rundll32.exe
9	1432	rundll32.exe
12	1432	rundll32.exe

pid	process
1536	regsvr32.exe
1432	rundll32.exe
1432	rundll32.exe
1432	rundll32.exe
1432	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

3bad137a2d5d20084fcf3fabf213ec08.exeregsvr32.exe

description	pid	process	target process
PID 1084 wrote to memory of 1536	1084	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 1084 wrote to memory of 1536	1084	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 1084 wrote to memory of 1536	1084	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 1084 wrote to memory of 1536	1084	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 1084 wrote to memory of 1536	1084	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 1084 wrote to memory of 1536	1084	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 1084 wrote to memory of 1536	1084	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 1536 wrote to memory of 1432	1536	regsvr32.exe	rundll32.exe
PID 1536 wrote to memory of 1432	1536	regsvr32.exe	rundll32.exe
PID 1536 wrote to memory of 1432	1536	regsvr32.exe	rundll32.exe
PID 1536 wrote to memory of 1432	1536	regsvr32.exe	rundll32.exe
PID 1536 wrote to memory of 1432	1536	regsvr32.exe	rundll32.exe
PID 1536 wrote to memory of 1432	1536	regsvr32.exe	rundll32.exe
PID 1536 wrote to memory of 1432	1536	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\3bad137a2d5d20084fcf3fabf213ec08.exe
"C:\Users\Admin\AppData\Local\Temp\3bad137a2d5d20084fcf3fabf213ec08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\3BAD13~1.EXE@1084
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
memory/1084-0-0x0000000000230000-0x00000000002FF000-memory.dmp

Filesize
828KB

Download
memory/1084-1-0x0000000002000000-0x0000000002011000-memory.dmp

Filesize
68KB

Download
memory/1432-5-0x0000000000000000-mapping.dmp

Download
memory/1536-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing