danabot | 8c98355387cdad4550e82d642575634034955262583962b63617d8e2d79956bd

General

Target

5f8c7a8a8095a14d504172acff266239.exe
Size

1.0MB
MD5

5f8c7a8a8095a14d504172acff266239
SHA1

a7dadbba24f6b98f84b073f999dab22c9c8ecfd4
SHA256

8c98355387cdad4550e82d642575634034955262583962b63617d8e2d79956bd
SHA512

7fd6934999f755ca9bdbe02b98b3707febca1d8134f0461137eccf5e6a575fd9826a544805ef23ef9e8b05b47d3e6b2446d37d5fed1d6b228067c4d89111e134

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

2.56.213.39

185.238.168.83

185.238.168.174

93.115.20.189

93.115.20.183

5.61.58.130

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL	family_danabot

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

14 2416 rundll32.exe
15 2416 rundll32.exe
16 2416 rundll32.exe
17 2416 rundll32.exe
19 2416 rundll32.exe
20 2416 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3868 regsvr32.exe
3868 regsvr32.exe
2416 rundll32.exe

flow	pid	process
14	2416	rundll32.exe
15	2416	rundll32.exe
16	2416	rundll32.exe
17	2416	rundll32.exe
19	2416	rundll32.exe
20	2416	rundll32.exe

pid	process
3868	regsvr32.exe
3868	regsvr32.exe
2416	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5f8c7a8a8095a14d504172acff266239.exeregsvr32.exe

description	pid	process	target process
PID 1020 wrote to memory of 3868	1020	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 1020 wrote to memory of 3868	1020	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 1020 wrote to memory of 3868	1020	5f8c7a8a8095a14d504172acff266239.exe	regsvr32.exe
PID 3868 wrote to memory of 2416	3868	regsvr32.exe	rundll32.exe
PID 3868 wrote to memory of 2416	3868	regsvr32.exe	rundll32.exe
PID 3868 wrote to memory of 2416	3868	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\5f8c7a8a8095a14d504172acff266239.exe
"C:\Users\Admin\AppData\Local\Temp\5f8c7a8a8095a14d504172acff266239.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.EXE@1020
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3868

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\5F8C7A~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
memory/1020-1-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/2416-6-0x0000000000000000-mapping.dmp

Download
memory/3868-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing