danabot | 94b9908c1d164acb68a30bacada251782c6e9dc64500718d12ebe4abf871b305

General

Target

8021a42dcacc5324aa57d3f9dc1ec637.exe
Size

2.7MB
MD5

8021a42dcacc5324aa57d3f9dc1ec637
SHA1

f4f08ba357d23403e2354d8e2be7acbccc266e55
SHA256

94b9908c1d164acb68a30bacada251782c6e9dc64500718d12ebe4abf871b305
SHA512

acb2fc354d4bf97740a43407ad4df3a744c92b0b8e10c480a898a96bc26d8f2594e82ec80ed1999b69f603f883cc824d2cb34d05a50937632888589c847c7949

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

51.77.7.204

51.178.195.151

51.222.39.81

185.227.138.47

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 5 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\8021A4~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\8021A4~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\8021A4~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\8021A4~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\8021A4~1.DLL	family_danabot

Blocklisted process makes network request 9 IoCs

Processes:

rundll32.exe

flow	pid	process
13	2752	rundll32.exe
17	2752	rundll32.exe
18	2752	rundll32.exe
19	2752	rundll32.exe
20	2752	rundll32.exe
21	2752	rundll32.exe
22	2752	rundll32.exe
23	2752	rundll32.exe
24	2752	rundll32.exe

Loads dropped DLL 4 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1448 regsvr32.exe
1448 regsvr32.exe
2752 rundll32.exe
2752 rundll32.exe

pid	process
1448	regsvr32.exe
1448	regsvr32.exe
2752	rundll32.exe
2752	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8021a42dcacc5324aa57d3f9dc1ec637.exeregsvr32.exe

description	pid	process	target process
PID 972 wrote to memory of 1448	972	8021a42dcacc5324aa57d3f9dc1ec637.exe	regsvr32.exe
PID 972 wrote to memory of 1448	972	8021a42dcacc5324aa57d3f9dc1ec637.exe	regsvr32.exe
PID 972 wrote to memory of 1448	972	8021a42dcacc5324aa57d3f9dc1ec637.exe	regsvr32.exe
PID 1448 wrote to memory of 2752	1448	regsvr32.exe	rundll32.exe
PID 1448 wrote to memory of 2752	1448	regsvr32.exe	rundll32.exe
PID 1448 wrote to memory of 2752	1448	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\8021a42dcacc5324aa57d3f9dc1ec637.exe
"C:\Users\Admin\AppData\Local\Temp\8021a42dcacc5324aa57d3f9dc1ec637.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\8021A4~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\8021A4~1.EXE@972
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\8021A4~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8021A4~1.DLL
MD5
632b1080b50ca66720e9b6b11074c833

SHA1
612fafb290616736791ca69f96293a8cb136ca93

SHA256
a67b380b75fd67a22f73657c63918d4fc4828dd3268312bc8c5edecd9b8251a0

SHA512
6bfc87661c1bb7897ab999e87e40eb6011d168c67852352d18c60ea81f237589a236be5bcfc36d4e67879b7b35c4d5c3b3e1f7200f9d41f9c59fd8bdf5db7beb

Download Submit
\Users\Admin\AppData\Local\Temp\8021A4~1.DLL
MD5
632b1080b50ca66720e9b6b11074c833

SHA1
612fafb290616736791ca69f96293a8cb136ca93

SHA256
a67b380b75fd67a22f73657c63918d4fc4828dd3268312bc8c5edecd9b8251a0

SHA512
6bfc87661c1bb7897ab999e87e40eb6011d168c67852352d18c60ea81f237589a236be5bcfc36d4e67879b7b35c4d5c3b3e1f7200f9d41f9c59fd8bdf5db7beb

Download Submit
\Users\Admin\AppData\Local\Temp\8021A4~1.DLL
MD5
632b1080b50ca66720e9b6b11074c833

SHA1
612fafb290616736791ca69f96293a8cb136ca93

SHA256
a67b380b75fd67a22f73657c63918d4fc4828dd3268312bc8c5edecd9b8251a0

SHA512
6bfc87661c1bb7897ab999e87e40eb6011d168c67852352d18c60ea81f237589a236be5bcfc36d4e67879b7b35c4d5c3b3e1f7200f9d41f9c59fd8bdf5db7beb

Download Submit
\Users\Admin\AppData\Local\Temp\8021A4~1.DLL
MD5
632b1080b50ca66720e9b6b11074c833

SHA1
612fafb290616736791ca69f96293a8cb136ca93

SHA256
a67b380b75fd67a22f73657c63918d4fc4828dd3268312bc8c5edecd9b8251a0

SHA512
6bfc87661c1bb7897ab999e87e40eb6011d168c67852352d18c60ea81f237589a236be5bcfc36d4e67879b7b35c4d5c3b3e1f7200f9d41f9c59fd8bdf5db7beb

Download Submit
\Users\Admin\AppData\Local\Temp\8021A4~1.DLL
MD5
632b1080b50ca66720e9b6b11074c833

SHA1
612fafb290616736791ca69f96293a8cb136ca93

SHA256
a67b380b75fd67a22f73657c63918d4fc4828dd3268312bc8c5edecd9b8251a0

SHA512
6bfc87661c1bb7897ab999e87e40eb6011d168c67852352d18c60ea81f237589a236be5bcfc36d4e67879b7b35c4d5c3b3e1f7200f9d41f9c59fd8bdf5db7beb

Download Submit
memory/972-1-0x0000000002740000-0x0000000002741000-memory.dmp

Filesize
4KB

Download
memory/1448-2-0x0000000000000000-mapping.dmp

Download
memory/2752-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads