danabot | f377512454adebec7f32f1a33bda63e3476595be7857fb73c0e242407f29f616

General

Target

SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe
Size

1.0MB
MD5

a83f8f6e2f733845af01838054187d30
SHA1

857f6df8a63ea4df0022463e8ad8d0e73dfbe409
SHA256

f377512454adebec7f32f1a33bda63e3476595be7857fb73c0e242407f29f616
SHA512

7fde752e208fac0c4dee2e7e436add312cbb52d7271aba3d3b1f90f29c50d89225143634d3f54eaa5406c4cfbaf3dfa0b91d22e329d3ca99fe64a01726bdb2ed

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

2.56.213.39

185.238.168.83

185.238.168.174

93.115.20.189

93.115.20.183

5.61.58.130

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 3 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

19 932 rundll32.exe
20 932 rundll32.exe
21 932 rundll32.exe
22 932 rundll32.exe
23 932 rundll32.exe
24 932 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

196 regsvr32.exe
932 rundll32.exe

flow	pid	process
19	932	rundll32.exe
20	932	rundll32.exe
21	932	rundll32.exe
22	932	rundll32.exe
23	932	rundll32.exe
24	932	rundll32.exe

pid	process
196	regsvr32.exe
932	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exeregsvr32.exe

description	pid	process	target process
PID 500 wrote to memory of 196	500	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 500 wrote to memory of 196	500	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 500 wrote to memory of 196	500	SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe	regsvr32.exe
PID 196 wrote to memory of 932	196	regsvr32.exe	rundll32.exe
PID 196 wrote to memory of 932	196	regsvr32.exe	rundll32.exe
PID 196 wrote to memory of 932	196	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:500

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@500
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:196

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
memory/196-2-0x0000000000000000-mapping.dmp

Download
memory/500-1-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/932-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing