danabot | 46c14ac886a864d3ff77606286c4ce983a060d57bcd07881ab299b1848918af5

General

Target

3bad137a2d5d20084fcf3fabf213ec08.exe
Size

1.0MB
MD5

3bad137a2d5d20084fcf3fabf213ec08
SHA1

079a6f24108c97a32923369b9e0e348c39bbf5dd
SHA256

46c14ac886a864d3ff77606286c4ce983a060d57bcd07881ab299b1848918af5
SHA512

475caf00146c93795752f0771cccee342edb17f5bdd9a778b885a7e34bf97b10b2569065093984cfb716033a3943b0f7681b9fcc80d5ffb973f19d70b6191b03

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

2.56.213.39

185.238.168.83

185.238.168.174

93.115.20.189

93.115.20.183

5.61.58.130

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL	family_danabot

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

13 1004 rundll32.exe
14 1004 rundll32.exe
16 1004 rundll32.exe
17 1004 rundll32.exe
18 1004 rundll32.exe
19 1004 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3320 regsvr32.exe
1004 rundll32.exe
1004 rundll32.exe

flow	pid	process
13	1004	rundll32.exe
14	1004	rundll32.exe
16	1004	rundll32.exe
17	1004	rundll32.exe
18	1004	rundll32.exe
19	1004	rundll32.exe

pid	process
3320	regsvr32.exe
1004	rundll32.exe
1004	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3bad137a2d5d20084fcf3fabf213ec08.exeregsvr32.exe

description	pid	process	target process
PID 3284 wrote to memory of 3320	3284	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 3284 wrote to memory of 3320	3284	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 3284 wrote to memory of 3320	3284	3bad137a2d5d20084fcf3fabf213ec08.exe	regsvr32.exe
PID 3320 wrote to memory of 1004	3320	regsvr32.exe	rundll32.exe
PID 3320 wrote to memory of 1004	3320	regsvr32.exe	rundll32.exe
PID 3320 wrote to memory of 1004	3320	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\3bad137a2d5d20084fcf3fabf213ec08.exe
"C:\Users\Admin\AppData\Local\Temp\3bad137a2d5d20084fcf3fabf213ec08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\3BAD13~1.EXE@3284
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3320

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\3BAD13~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
memory/1004-5-0x0000000000000000-mapping.dmp

Download
memory/3284-1-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3320-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing