danabot | 301fb66cb50056dca7644f1b087a2bfbba0f9649a8e5571fe1845d704cd78913

General

Target

SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe
Size

940KB
MD5

c67f60855d4ba3d15799f99b3fe23cf6
SHA1

59a33e61e3f5e31bd56405b23ba59dcc1d3e9012
SHA256

301fb66cb50056dca7644f1b087a2bfbba0f9649a8e5571fe1845d704cd78913
SHA512

d33e2eaafb7356db222a6f533d691aac0df4b7f6043cfbd062d38bcf4156b5840d2720dc83a66b0b69e3f1e432f5199112fe42556e9d9cb3b49b53689c7d2a6a

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

54.38.22.65

192.99.219.207

51.255.134.130

192.236.179.73

23.82.140.201

172.81.129.196

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL	family_danabot

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

2 1624 rundll32.exe
5 1624 rundll32.exe
6 1624 rundll32.exe
7 1624 rundll32.exe
8 1624 rundll32.exe
11 1624 rundll32.exe
14 1624 rundll32.exe
Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1640 regsvr32.exe
1624 rundll32.exe
1624 rundll32.exe
1624 rundll32.exe
1624 rundll32.exe

flow	pid	process
2	1624	rundll32.exe
5	1624	rundll32.exe
6	1624	rundll32.exe
7	1624	rundll32.exe
8	1624	rundll32.exe
11	1624	rundll32.exe
14	1624	rundll32.exe

pid	process
1640	regsvr32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

SecuriteInfo.com.Variant.Danabot.2.7796.25479.exeregsvr32.exe

description	pid	process	target process
PID 1900 wrote to memory of 1640	1900	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	regsvr32.exe
PID 1900 wrote to memory of 1640	1900	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	regsvr32.exe
PID 1900 wrote to memory of 1640	1900	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	regsvr32.exe
PID 1900 wrote to memory of 1640	1900	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	regsvr32.exe
PID 1900 wrote to memory of 1640	1900	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	regsvr32.exe
PID 1900 wrote to memory of 1640	1900	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	regsvr32.exe
PID 1900 wrote to memory of 1640	1900	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	regsvr32.exe
PID 1640 wrote to memory of 1624	1640	regsvr32.exe	rundll32.exe
PID 1640 wrote to memory of 1624	1640	regsvr32.exe	rundll32.exe
PID 1640 wrote to memory of 1624	1640	regsvr32.exe	rundll32.exe
PID 1640 wrote to memory of 1624	1640	regsvr32.exe	rundll32.exe
PID 1640 wrote to memory of 1624	1640	regsvr32.exe	rundll32.exe
PID 1640 wrote to memory of 1624	1640	regsvr32.exe	rundll32.exe
PID 1640 wrote to memory of 1624	1640	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@1900
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c

SHA1
c34d0a6389836324bc7da05005fc2d1662652ed4

SHA256
b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0

SHA512
980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c

SHA1
c34d0a6389836324bc7da05005fc2d1662652ed4

SHA256
b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0

SHA512
980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c

SHA1
c34d0a6389836324bc7da05005fc2d1662652ed4

SHA256
b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0

SHA512
980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c

SHA1
c34d0a6389836324bc7da05005fc2d1662652ed4

SHA256
b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0

SHA512
980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c

SHA1
c34d0a6389836324bc7da05005fc2d1662652ed4

SHA256
b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0

SHA512
980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.DLL

MD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c

SHA1
c34d0a6389836324bc7da05005fc2d1662652ed4

SHA256
b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0

SHA512
980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429

Download Submit
memory/1624-3-0x0000000000000000-mapping.dmp

Download
memory/1640-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing