danabot | 938a3ebb1e0134070a4f75ea35eb5d083de6e419549b687725cac66220b0004c

General

Target

F78E05D4.dll
Size

2.2MB
MD5

88d6e37ff27f0417402d8f5ca25bbcb9
SHA1

5ef6d17fa7171ec8018d13c968c570ff689645ff
SHA256

938a3ebb1e0134070a4f75ea35eb5d083de6e419549b687725cac66220b0004c
SHA512

37aa2c00ad2f791d29794d2b23430d72a3df4a90095d69b70fc13efadb413d21d4136adb7ffbf9d8d3286aaadcaf1355d1b04864b322378aa31944b35b68cea7

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

C2

172.81.129.196

54.38.22.65

192.99.219.207

51.255.134.130

192.236.179.73

23.82.140.201

45.147.228.92

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

2 2028 rundll32.exe
5 2028 rundll32.exe
8 2028 rundll32.exe
11 2028 rundll32.exe
12 2028 rundll32.exe
15 2028 rundll32.exe
16 2028 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1976 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2040 WerFault.exe

flow	pid	process
2	2028	rundll32.exe
5	2028	rundll32.exe
8	2028	rundll32.exe
11	2028	rundll32.exe
12	2028	rundll32.exe
15	2028	rundll32.exe
16	2028	rundll32.exe

pid	pid_target	process	target process
2040	1976	WerFault.exe	rundll32.exe

pid	process
2040	WerFault.exe
2040	WerFault.exe
2040	WerFault.exe
2040	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2040	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1080 wrote to memory of 1976	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1976	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1976	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1976	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1976	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1976	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1976	1080	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2028	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2028	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2028	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2028	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2028	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2028	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2028	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2040	1976	rundll32.exe	WerFault.exe
PID 1976 wrote to memory of 2040	1976	rundll32.exe	WerFault.exe
PID 1976 wrote to memory of 2040	1976	rundll32.exe	WerFault.exe
PID 1976 wrote to memory of 2040	1976	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F78E05D4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F78E05D4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\F78E05D4.dll,f0
3⤵
- Blocklisted process makes network request
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 384
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-0-0x0000000000000000-mapping.dmp

Download
memory/1976-4-0x0000000000000000-mapping.dmp

Download
memory/1976-5-0x0000000000000000-mapping.dmp

Download
memory/2028-1-0x0000000000000000-mapping.dmp

Download
memory/2040-2-0x0000000000000000-mapping.dmp

Download
memory/2040-3-0x0000000001FC0000-0x0000000001FD1000-memory.dmp

Filesize
68KB

Download
memory/2040-6-0x00000000026B0000-0x00000000026C1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing