danabot | a7c37af821063d0a3be82a621e332f48c89bd83bec9c3ad092d4e357813c7e66

General

Target

2dfea66c532054e14a50066d4f278b38.exe
Size

2.6MB
MD5

2dfea66c532054e14a50066d4f278b38
SHA1

c1e577f41d4c06cee4cf0f2917682dfe81cb7ad9
SHA256

a7c37af821063d0a3be82a621e332f48c89bd83bec9c3ad092d4e357813c7e66
SHA512

30ce45d030ce432f9af5db35eaf79a9a56034b407d9eea8ab4e6ca554b3af8cd8136520590496841f3a547d525a1b120b4b3df5b025ca8a3b8b70570a2ba1123

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

38.68.50.140

38.68.50.172

172.241.27.92

45.135.167.14

37.120.145.180

95.174.65.203

185.227.138.47

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot

Blocklisted process makes network request 9 IoCs

Processes:

rundll32.exe

flow	pid	process
2	1196	rundll32.exe
3	1196	rundll32.exe
4	1196	rundll32.exe
7	1196	rundll32.exe
10	1196	rundll32.exe
11	1196	rundll32.exe
12	1196	rundll32.exe
13	1196	rundll32.exe
14	1196	rundll32.exe

Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1616 regsvr32.exe
1196 rundll32.exe
1196 rundll32.exe
1196 rundll32.exe
1196 rundll32.exe

pid	process
1616	regsvr32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2dfea66c532054e14a50066d4f278b38.exeregsvr32.exe

description	pid	process	target process
PID 1700 wrote to memory of 1616	1700	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\2dfea66c532054e14a50066d4f278b38.exe
"C:\Users\Admin\AppData\Local\Temp\2dfea66c532054e14a50066d4f278b38.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.EXE@1700
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
89fc5cc09b11dfb2d9e6fa7de1b19de7

SHA1
b9b7dec4050e65785842b407005498ce4684be06

SHA256
24337f04d4bd779249f61cd148d971163f80fa9106d04f5f332f2bf1696c4b92

SHA512
de31289b79de6dfb9c32779b3486989120095449955d627113f5bcc07b432702dae97c79ec142381b2aebd1260e0cb8f16009c45b5babd45ce1ffc190e607459

Download Submit
memory/1196-5-0x0000000000000000-mapping.dmp

Download
memory/1616-2-0x0000000000000000-mapping.dmp

Download
memory/1700-0-0x00000000020A0000-0x0000000002317000-memory.dmp

Filesize
2.5MB

Download
memory/1700-1-0x0000000002320000-0x0000000002331000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads