danabot | 465e874f504c413d6971a48c1ba559d83cc622bd1884b18d1cae1cca608f42ab

General

Target

80dddef3baccbd90d5dfd016cbe454ea.exe
Size

940KB
MD5

80dddef3baccbd90d5dfd016cbe454ea
SHA1

f6531c5a548e847c7876fa72d2689348e1bb6acb
SHA256

465e874f504c413d6971a48c1ba559d83cc622bd1884b18d1cae1cca608f42ab
SHA512

e32dcca39686a8c585158080aaaba56dbeb9464f03a4246eb28a136d91a232a09436fb7cd2e997e3662d6405b172b82fdf9dd507b5a1da1e73cdd103f4aa35ca

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

54.38.22.65

192.99.219.207

51.255.134.130

192.236.179.73

23.82.140.201

172.81.129.196

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 3 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\80DDDE~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\80DDDE~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\80DDDE~1.DLL	family_danabot

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

9 712 rundll32.exe
15 712 rundll32.exe
16 712 rundll32.exe
17 712 rundll32.exe
18 712 rundll32.exe
22 712 rundll32.exe
23 712 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

2764 regsvr32.exe
712 rundll32.exe

flow	pid	process
9	712	rundll32.exe
15	712	rundll32.exe
16	712	rundll32.exe
17	712	rundll32.exe
18	712	rundll32.exe
22	712	rundll32.exe
23	712	rundll32.exe

pid	process
2764	regsvr32.exe
712	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

80dddef3baccbd90d5dfd016cbe454ea.exeregsvr32.exe

description	pid	process	target process
PID 1812 wrote to memory of 2764	1812	80dddef3baccbd90d5dfd016cbe454ea.exe	regsvr32.exe
PID 1812 wrote to memory of 2764	1812	80dddef3baccbd90d5dfd016cbe454ea.exe	regsvr32.exe
PID 1812 wrote to memory of 2764	1812	80dddef3baccbd90d5dfd016cbe454ea.exe	regsvr32.exe
PID 2764 wrote to memory of 712	2764	regsvr32.exe	rundll32.exe
PID 2764 wrote to memory of 712	2764	regsvr32.exe	rundll32.exe
PID 2764 wrote to memory of 712	2764	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\80dddef3baccbd90d5dfd016cbe454ea.exe
"C:\Users\Admin\AppData\Local\Temp\80dddef3baccbd90d5dfd016cbe454ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\80DDDE~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\80DDDE~1.EXE@1812
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\80DDDE~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80DDDE~1.DLL
MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
\Users\Admin\AppData\Local\Temp\80DDDE~1.DLL
MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
\Users\Admin\AppData\Local\Temp\80DDDE~1.DLL
MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
memory/712-3-0x0000000000000000-mapping.dmp

Download
memory/2764-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing