danabot | a7c37af821063d0a3be82a621e332f48c89bd83bec9c3ad092d4e357813c7e66

General

Target

2dfea66c532054e14a50066d4f278b38.exe
Size

2.6MB
MD5

2dfea66c532054e14a50066d4f278b38
SHA1

c1e577f41d4c06cee4cf0f2917682dfe81cb7ad9
SHA256

a7c37af821063d0a3be82a621e332f48c89bd83bec9c3ad092d4e357813c7e66
SHA512

30ce45d030ce432f9af5db35eaf79a9a56034b407d9eea8ab4e6ca554b3af8cd8136520590496841f3a547d525a1b120b4b3df5b025ca8a3b8b70570a2ba1123

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

38.68.50.140

38.68.50.172

172.241.27.92

45.135.167.14

37.120.145.180

95.174.65.203

185.227.138.47

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL	family_danabot

Blocklisted process makes network request 9 IoCs

Processes:

rundll32.exe

flow	pid	process
12	3704	rundll32.exe
15	3704	rundll32.exe
16	3704	rundll32.exe
19	3704	rundll32.exe
20	3704	rundll32.exe
23	3704	rundll32.exe
26	3704	rundll32.exe
29	3704	rundll32.exe
30	3704	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1952 regsvr32.exe
3704 rundll32.exe
3704 rundll32.exe

pid	process
1952	regsvr32.exe
3704	rundll32.exe
3704	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2dfea66c532054e14a50066d4f278b38.exeregsvr32.exe

description	pid	process	target process
PID 732 wrote to memory of 1952	732	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 732 wrote to memory of 1952	732	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 732 wrote to memory of 1952	732	2dfea66c532054e14a50066d4f278b38.exe	regsvr32.exe
PID 1952 wrote to memory of 3704	1952	regsvr32.exe	rundll32.exe
PID 1952 wrote to memory of 3704	1952	regsvr32.exe	rundll32.exe
PID 1952 wrote to memory of 3704	1952	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\2dfea66c532054e14a50066d4f278b38.exe
"C:\Users\Admin\AppData\Local\Temp\2dfea66c532054e14a50066d4f278b38.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.EXE@732
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
\Users\Admin\AppData\Local\Temp\2DFEA6~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
memory/732-1-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1952-2-0x0000000000000000-mapping.dmp

Download
memory/3704-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads