danabot | d447a466b5bed2daffcd7a3ea6fea93a8d9fa32d62eadbf834d3a8713da05a4a

Analysis

max time kernel
139s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12f1cb18016343fe5ec091c042b31668.exe
Size 2.6MB
Sample201109-wbep91sgps
SHA256 d447a466b5bed2daffcd7a3ea6fea93a8d9fa32d62eadbf834d3a8713da05a4a
MD5 12f1cb18016343fe5ec091c042b31668
SHA1 84d515f65d5e6eb057f2c267be836af04b353b60
SHA512 a2b7c47ea0d2ea0ab15c22b776998aed2b5cd1b06da3d02839fc315b049cda7cd955f16439f1b3565a9fe8d1d68acd7ca2ff337aa2ad301b7f21ebead10fb0ed
MD5 SHA1 SHA512

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

38.68.50.140
38.68.50.172
172.241.27.92
45.135.167.14
37.120.145.180
95.174.65.203
185.227.138.47

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x00040000000130f5-3.dat	family_danabot
behavioral1/files/0x00040000000130f5-4.dat	family_danabot
behavioral1/files/0x00040000000130f5-9.dat	family_danabot
behavioral1/files/0x00040000000130f5-8.dat	family_danabot
behavioral1/files/0x00040000000130f5-7.dat	family_danabot
behavioral1/files/0x00040000000130f5-6.dat	family_danabot

Blocklisted process makes network request 9 IoCs

flow	pid	Process
2	316	rundll32.exe
3	316	rundll32.exe
6	316	rundll32.exe
7	316	rundll32.exe
10	316	rundll32.exe
11	316	rundll32.exe
12	316	rundll32.exe
13	316	rundll32.exe
14	316	rundll32.exe

Loads dropped DLL 5 IoCs

pid	Process
1200	regsvr32.exe
316	rundll32.exe
316	rundll32.exe
316	rundll32.exe
316	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1200	752	12f1cb18016343fe5ec091c042b31668.exe	30
PID 752 wrote to memory of 1200	752	12f1cb18016343fe5ec091c042b31668.exe	30
PID 752 wrote to memory of 1200	752	12f1cb18016343fe5ec091c042b31668.exe	30
PID 752 wrote to memory of 1200	752	12f1cb18016343fe5ec091c042b31668.exe	30
PID 752 wrote to memory of 1200	752	12f1cb18016343fe5ec091c042b31668.exe	30
PID 752 wrote to memory of 1200	752	12f1cb18016343fe5ec091c042b31668.exe	30
PID 752 wrote to memory of 1200	752	12f1cb18016343fe5ec091c042b31668.exe	30
PID 1200 wrote to memory of 316	1200	regsvr32.exe	31
PID 1200 wrote to memory of 316	1200	regsvr32.exe	31
PID 1200 wrote to memory of 316	1200	regsvr32.exe	31
PID 1200 wrote to memory of 316	1200	regsvr32.exe	31
PID 1200 wrote to memory of 316	1200	regsvr32.exe	31
PID 1200 wrote to memory of 316	1200	regsvr32.exe	31
PID 1200 wrote to memory of 316	1200	regsvr32.exe	31

C:\Users\Admin\AppData\Local\Temp\12f1cb18016343fe5ec091c042b31668.exe
"C:\Users\Admin\AppData\Local\Temp\12f1cb18016343fe5ec091c042b31668.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\12F1CB~1.EXE@752
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-0-0x00000000020B0000-0x0000000002327000-memory.dmp

Download

memory/752-1-0x0000000002330000-0x0000000002341000-memory.dmp