danabot | 99b57af659b47128ffbae221dd8523c29e2ee7c21da77d5258b8b6c839c1d378

General

Target

SecuriteInfo.com.Variant.Danabot.2.16004.30686.exe
Size

940KB
MD5

9eb0aebd25f98f98e43e3834522c53c9
SHA1

64bad90f8b64195814994f92b1e632f5691b8072
SHA256

99b57af659b47128ffbae221dd8523c29e2ee7c21da77d5258b8b6c839c1d378
SHA512

66b9735e48963d0d1224cc87d74d7ce7f8a73721c04344da69aa389e19918e9a0045fbd6b4b7b366805ba0ebea0a1262890a82917f17a86e1fa9a3d7709769f2

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

54.38.22.65

192.99.219.207

51.255.134.130

192.236.179.73

23.82.140.201

172.81.129.196

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

11 692 rundll32.exe
16 692 rundll32.exe
18 692 rundll32.exe
19 692 rundll32.exe
20 692 rundll32.exe
21 692 rundll32.exe
22 692 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

4044 regsvr32.exe
4044 regsvr32.exe
692 rundll32.exe

flow	pid	process
11	692	rundll32.exe
16	692	rundll32.exe
18	692	rundll32.exe
19	692	rundll32.exe
20	692	rundll32.exe
21	692	rundll32.exe
22	692	rundll32.exe

pid	process
4044	regsvr32.exe
4044	regsvr32.exe
692	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Variant.Danabot.2.16004.30686.exeregsvr32.exe

description	pid	process	target process
PID 984 wrote to memory of 4044	984	SecuriteInfo.com.Variant.Danabot.2.16004.30686.exe	regsvr32.exe
PID 984 wrote to memory of 4044	984	SecuriteInfo.com.Variant.Danabot.2.16004.30686.exe	regsvr32.exe
PID 984 wrote to memory of 4044	984	SecuriteInfo.com.Variant.Danabot.2.16004.30686.exe	regsvr32.exe
PID 4044 wrote to memory of 692	4044	regsvr32.exe	rundll32.exe
PID 4044 wrote to memory of 692	4044	regsvr32.exe	rundll32.exe
PID 4044 wrote to memory of 692	4044	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Danabot.2.16004.30686.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Danabot.2.16004.30686.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@984
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
memory/692-4-0x0000000000000000-mapping.dmp

Download
memory/4044-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing