danabot | da14fc981ff7eaaa731ffddfbe830230387467a19b191c48491d2583ceab9666

General

Target

9847cdb2332e3f43e3e10ed655e4788f.exe
Size

940KB
MD5

9847cdb2332e3f43e3e10ed655e4788f
SHA1

e85e09680acb5c97781ad6a785e6223bc8f614bd
SHA256

da14fc981ff7eaaa731ffddfbe830230387467a19b191c48491d2583ceab9666
SHA512

c4e4b4192411859e8d3938eea5f13d3c5461a6aede00ad331af01233a0ef90dfa50aefa5d888518f01b7e9f5400d9903d852cfb915cd6534722bf4dc6f578e13

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

54.38.22.65

192.99.219.207

51.255.134.130

192.236.179.73

23.82.140.201

172.81.129.196

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\9847CD~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\9847CD~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\9847CD~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\9847CD~1.DLL	family_danabot

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

10 1940 rundll32.exe
17 1940 rundll32.exe
18 1940 rundll32.exe
20 1940 rundll32.exe
22 1940 rundll32.exe
23 1940 rundll32.exe
24 1940 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

192 regsvr32.exe
1940 rundll32.exe
1940 rundll32.exe

flow	pid	process
10	1940	rundll32.exe
17	1940	rundll32.exe
18	1940	rundll32.exe
20	1940	rundll32.exe
22	1940	rundll32.exe
23	1940	rundll32.exe
24	1940	rundll32.exe

pid	process
192	regsvr32.exe
1940	rundll32.exe
1940	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9847cdb2332e3f43e3e10ed655e4788f.exeregsvr32.exe

description	pid	process	target process
PID 796 wrote to memory of 192	796	9847cdb2332e3f43e3e10ed655e4788f.exe	regsvr32.exe
PID 796 wrote to memory of 192	796	9847cdb2332e3f43e3e10ed655e4788f.exe	regsvr32.exe
PID 796 wrote to memory of 192	796	9847cdb2332e3f43e3e10ed655e4788f.exe	regsvr32.exe
PID 192 wrote to memory of 1940	192	regsvr32.exe	rundll32.exe
PID 192 wrote to memory of 1940	192	regsvr32.exe	rundll32.exe
PID 192 wrote to memory of 1940	192	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\9847cdb2332e3f43e3e10ed655e4788f.exe
"C:\Users\Admin\AppData\Local\Temp\9847cdb2332e3f43e3e10ed655e4788f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\9847CD~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\9847CD~1.EXE@796
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:192

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9847CD~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9847CD~1.DLL
MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
\Users\Admin\AppData\Local\Temp\9847CD~1.DLL
MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
\Users\Admin\AppData\Local\Temp\9847CD~1.DLL
MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
\Users\Admin\AppData\Local\Temp\9847CD~1.DLL
MD5
8aa7491854211e45e06d93a459d9219c

SHA1
19b86b9f68203fad59e8edd4cd6c8a7b53ba959e

SHA256
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774

SHA512
bd1b9688bfea2c739ec51421e9e113be59952803805de455aad65f8bf3c25b7e50f02016330e5e24d8c6151fdd8be9d66f2da685f0a3d9098e002a88514752c4

Download Submit
memory/192-0-0x0000000000000000-mapping.dmp

Download
memory/1940-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing