danabot | 8c98355387cdad4550e82d642575634034955262583962b63617d8e2d79956bd

General

Target

5f8c7a8a8095a14d504172acff266239.exe
Size

1.0MB
MD5

5f8c7a8a8095a14d504172acff266239
SHA1

a7dadbba24f6b98f84b073f999dab22c9c8ecfd4
SHA256

8c98355387cdad4550e82d642575634034955262583962b63617d8e2d79956bd
SHA512

7fd6934999f755ca9bdbe02b98b3707febca1d8134f0461137eccf5e6a575fd9826a544805ef23ef9e8b05b47d3e6b2446d37d5fed1d6b228067c4d89111e134

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

2.56.213.39

185.238.168.83

185.238.168.174

93.115.20.189

93.115.20.183

5.61.58.130

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

3 1244 rundll32.exe
4 1244 rundll32.exe
5 1244 rundll32.exe
8 1244 rundll32.exe
9 1244 rundll32.exe
10 1244 rundll32.exe
11 1244 rundll32.exe
Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

872 regsvr32.exe
1244 rundll32.exe
1244 rundll32.exe
1244 rundll32.exe
1244 rundll32.exe

flow	pid	process
3	1244	rundll32.exe
4	1244	rundll32.exe
5	1244	rundll32.exe
8	1244	rundll32.exe
9	1244	rundll32.exe
10	1244	rundll32.exe
11	1244	rundll32.exe

pid	process
872	regsvr32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe
1244	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

5f8c7a8a8095a14d504172acff266239.exeregsvr32.exe

description	pid	process	target process
PID 1756 wrote to memory of 872	1756	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 1756 wrote to memory of 872	1756	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 1756 wrote to memory of 872	1756	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 1756 wrote to memory of 872	1756	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 1756 wrote to memory of 872	1756	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 1756 wrote to memory of 872	1756	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 1756 wrote to memory of 872	1756	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 872 wrote to memory of 1244	872	regsvr32.exe	rundll32.exe
PID 872 wrote to memory of 1244	872	regsvr32.exe	rundll32.exe
PID 872 wrote to memory of 1244	872	regsvr32.exe	rundll32.exe
PID 872 wrote to memory of 1244	872	regsvr32.exe	rundll32.exe
PID 872 wrote to memory of 1244	872	regsvr32.exe	rundll32.exe
PID 872 wrote to memory of 1244	872	regsvr32.exe	rundll32.exe
PID 872 wrote to memory of 1244	872	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\5f8c7a8a8095a14d504172acff266239.exe
"C:\Users\Admin\AppData\Local\Temp\5f8c7a8a8095a14d504172acff266239.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.EXE@1756
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
memory/872-2-0x0000000000000000-mapping.dmp

Download
memory/1244-5-0x0000000000000000-mapping.dmp

Download
memory/1756-0-0x0000000000320000-0x00000000003EF000-memory.dmp

Filesize
828KB

Download
memory/1756-1-0x0000000001DB0000-0x0000000001DC1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing