danabot | 938a3ebb1e0134070a4f75ea35eb5d083de6e419549b687725cac66220b0004c

Analysis

max time kernel
149s
max time network
152s
platform
windows10_x64
resource
win10v20201028
submitted
09-11-2020 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

F78E05D4.dll
Size

2.2MB
MD5

88d6e37ff27f0417402d8f5ca25bbcb9
SHA1

5ef6d17fa7171ec8018d13c968c570ff689645ff
SHA256

938a3ebb1e0134070a4f75ea35eb5d083de6e419549b687725cac66220b0004c
SHA512

37aa2c00ad2f791d29794d2b23430d72a3df4a90095d69b70fc13efadb413d21d4136adb7ffbf9d8d3286aaadcaf1355d1b04864b322378aa31944b35b68cea7

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

172.81.129.196

54.38.22.65

192.99.219.207

51.255.134.130

192.236.179.73

23.82.140.201

45.147.228.92

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow	pid	process
10	2128	rundll32.exe
20	2128	rundll32.exe
21	2128	rundll32.exe
23	2128	rundll32.exe
24	2128	rundll32.exe
26	2128	rundll32.exe
27	2128	rundll32.exe
28	2128	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3560 4732 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3560	4732	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3560 WerFault.exe
Token: SeBackupPrivilege 3560 WerFault.exe
Token: SeDebugPrivilege 3560 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3560	WerFault.exe
Token: SeBackupPrivilege	3560	WerFault.exe
Token: SeDebugPrivilege	3560	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4700 wrote to memory of 4732	4700	rundll32.exe	rundll32.exe
PID 4700 wrote to memory of 4732	4700	rundll32.exe	rundll32.exe
PID 4700 wrote to memory of 4732	4700	rundll32.exe	rundll32.exe
PID 4732 wrote to memory of 2128	4732	rundll32.exe	rundll32.exe
PID 4732 wrote to memory of 2128	4732	rundll32.exe	rundll32.exe
PID 4732 wrote to memory of 2128	4732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F78E05D4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F78E05D4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\F78E05D4.dll,f0
3⤵
- Blocklisted process makes network request
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 736
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-1-0x0000000000000000-mapping.dmp

Download
memory/3560-2-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/3560-3-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/3560-4-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/3560-8-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/4732-0-0x0000000000000000-mapping.dmp

Download
memory/4732-5-0x0000000000000000-mapping.dmp

Download
memory/4732-6-0x0000000000000000-mapping.dmp

Download
memory/4732-7-0x0000000000000000-mapping.dmp

Download