danabot | f377512454adebec7f32f1a33bda63e3476595be7857fb73c0e242407f29f616

General

Target

SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe
Size

1.0MB
MD5

a83f8f6e2f733845af01838054187d30
SHA1

857f6df8a63ea4df0022463e8ad8d0e73dfbe409
SHA256

f377512454adebec7f32f1a33bda63e3476595be7857fb73c0e242407f29f616
SHA512

7fde752e208fac0c4dee2e7e436add312cbb52d7271aba3d3b1f90f29c50d89225143634d3f54eaa5406c4cfbaf3dfa0b91d22e329d3ca99fe64a01726bdb2ed

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

2.56.213.39

185.238.168.83

185.238.168.174

93.115.20.189

93.115.20.183

5.61.58.130

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

2 1596 rundll32.exe
3 1596 rundll32.exe
6 1596 rundll32.exe
7 1596 rundll32.exe
8 1596 rundll32.exe
9 1596 rundll32.exe
10 1596 rundll32.exe
Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1444 regsvr32.exe
1596 rundll32.exe
1596 rundll32.exe
1596 rundll32.exe
1596 rundll32.exe

flow	pid	process
2	1596	rundll32.exe
3	1596	rundll32.exe
6	1596	rundll32.exe
7	1596	rundll32.exe
8	1596	rundll32.exe
9	1596	rundll32.exe
10	1596	rundll32.exe

pid	process
1444	regsvr32.exe
1596	rundll32.exe
1596	rundll32.exe
1596	rundll32.exe
1596	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exeregsvr32.exe

description	pid	process	target process
PID 1096 wrote to memory of 1444	1096	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 1096 wrote to memory of 1444	1096	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 1096 wrote to memory of 1444	1096	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 1096 wrote to memory of 1444	1096	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 1096 wrote to memory of 1444	1096	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 1096 wrote to memory of 1444	1096	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 1096 wrote to memory of 1444	1096	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 1444 wrote to memory of 1596	1444	regsvr32.exe	rundll32.exe
PID 1444 wrote to memory of 1596	1444	regsvr32.exe	rundll32.exe
PID 1444 wrote to memory of 1596	1444	regsvr32.exe	rundll32.exe
PID 1444 wrote to memory of 1596	1444	regsvr32.exe	rundll32.exe
PID 1444 wrote to memory of 1596	1444	regsvr32.exe	rundll32.exe
PID 1444 wrote to memory of 1596	1444	regsvr32.exe	rundll32.exe
PID 1444 wrote to memory of 1596	1444	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@1096
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
MD5
8c3fbae57302ba0230758f1cf37f1885

SHA1
66b97ddc99dce6bf9bdae7ef6b56a8c2d8a6e968

SHA256
2bdf1faf7c8c10bbf0edf19fa80812eb05c531331bb720434cd62dd87901ff2c

SHA512
2f4950abb9771887ecd532c9cac5ce27c468d5dd4d886865c041fef2fcfbf98d74dd3322af59fc0dbc6585dbb679cd4ffc7c6878fe226696d8d10a5fc0dedf7e

Download Submit
memory/1096-0-0x0000000000330000-0x00000000003FF000-memory.dmp

Filesize
828KB

Download
memory/1096-1-0x0000000001EB0000-0x0000000001EC1000-memory.dmp

Filesize
68KB

Download
memory/1444-2-0x0000000000000000-mapping.dmp

Download
memory/1596-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing