danabot | 02ef6ffbe2b06f3b6c2b6e3d3054bc80c5996f550cd8ecd9928cbb3e13928a16

Analysis

max time kernel
136s
max time network
144s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56ec14575dd92a3344e67cbe8e80ef4e.exe
Size 2.6MB
Sample201109-ty23fcnfee
SHA256 02ef6ffbe2b06f3b6c2b6e3d3054bc80c5996f550cd8ecd9928cbb3e13928a16
MD5 56ec14575dd92a3344e67cbe8e80ef4e
SHA1 15293a9ed72bfecce66ca8096c1ca11b94c9a203
SHA512 b0246f22398c3a946101923b151cf0ce80d5ed796345a6652f70623939aa3d27676acfe5dc9a9a86722859477acfbf653fd8858e07e6d53fa3f3b1d78f56dfe5
MD5 SHA1 SHA512

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

93.115.21.232
109.200.24.21
93.115.21.236

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x00040000000130fe-3.dat	family_danabot
behavioral1/files/0x00040000000130fe-4.dat	family_danabot
behavioral1/files/0x00040000000130fe-7.dat	family_danabot
behavioral1/files/0x00040000000130fe-8.dat	family_danabot
behavioral1/files/0x00040000000130fe-6.dat	family_danabot
behavioral1/files/0x00040000000130fe-9.dat	family_danabot

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	240	rundll32.exe
6	240	rundll32.exe
7	240	rundll32.exe
10	240	rundll32.exe
11	240	rundll32.exe
12	240	rundll32.exe
13	240	rundll32.exe

Loads dropped DLL 5 IoCs

pid	Process
544	regsvr32.exe
240	rundll32.exe
240	rundll32.exe
240	rundll32.exe
240	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 544	1992	56ec14575dd92a3344e67cbe8e80ef4e.exe	30
PID 1992 wrote to memory of 544	1992	56ec14575dd92a3344e67cbe8e80ef4e.exe	30
PID 1992 wrote to memory of 544	1992	56ec14575dd92a3344e67cbe8e80ef4e.exe	30
PID 1992 wrote to memory of 544	1992	56ec14575dd92a3344e67cbe8e80ef4e.exe	30
PID 1992 wrote to memory of 544	1992	56ec14575dd92a3344e67cbe8e80ef4e.exe	30
PID 1992 wrote to memory of 544	1992	56ec14575dd92a3344e67cbe8e80ef4e.exe	30
PID 1992 wrote to memory of 544	1992	56ec14575dd92a3344e67cbe8e80ef4e.exe	30
PID 544 wrote to memory of 240	544	regsvr32.exe	31
PID 544 wrote to memory of 240	544	regsvr32.exe	31
PID 544 wrote to memory of 240	544	regsvr32.exe	31
PID 544 wrote to memory of 240	544	regsvr32.exe	31
PID 544 wrote to memory of 240	544	regsvr32.exe	31
PID 544 wrote to memory of 240	544	regsvr32.exe	31
PID 544 wrote to memory of 240	544	regsvr32.exe	31

C:\Users\Admin\AppData\Local\Temp\56ec14575dd92a3344e67cbe8e80ef4e.exe
"C:\Users\Admin\AppData\Local\Temp\56ec14575dd92a3344e67cbe8e80ef4e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\56EC14~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\56EC14~1.EXE@1992
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\56EC14~1.DLL,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-0-0x00000000032A0000-0x0000000003517000-memory.dmp

Download

memory/1992-1-0x0000000003520000-0x0000000003531000-memory.dmp