danabot | d447a466b5bed2daffcd7a3ea6fea93a8d9fa32d62eadbf834d3a8713da05a4a

General

Target

12f1cb18016343fe5ec091c042b31668.exe
Size

2.6MB
MD5

12f1cb18016343fe5ec091c042b31668
SHA1

84d515f65d5e6eb057f2c267be836af04b353b60
SHA256

d447a466b5bed2daffcd7a3ea6fea93a8d9fa32d62eadbf834d3a8713da05a4a
SHA512

a2b7c47ea0d2ea0ab15c22b776998aed2b5cd1b06da3d02839fc315b049cda7cd955f16439f1b3565a9fe8d1d68acd7ca2ff337aa2ad301b7f21ebead10fb0ed

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

38.68.50.140

38.68.50.172

172.241.27.92

45.135.167.14

37.120.145.180

95.174.65.203

185.227.138.47

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 3 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL	family_danabot

Blocklisted process makes network request 9 IoCs

Processes:

rundll32.exe

flow	pid	process
9	196	rundll32.exe
13	196	rundll32.exe
14	196	rundll32.exe
15	196	rundll32.exe
16	196	rundll32.exe
18	196	rundll32.exe
19	196	rundll32.exe
21	196	rundll32.exe
22	196	rundll32.exe

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3116 regsvr32.exe
196 rundll32.exe

pid	process
3116	regsvr32.exe
196	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

12f1cb18016343fe5ec091c042b31668.exeregsvr32.exe

description	pid	process	target process
PID 640 wrote to memory of 3116	640	12f1cb18016343fe5ec091c042b31668.exe	regsvr32.exe
PID 640 wrote to memory of 3116	640	12f1cb18016343fe5ec091c042b31668.exe	regsvr32.exe
PID 640 wrote to memory of 3116	640	12f1cb18016343fe5ec091c042b31668.exe	regsvr32.exe
PID 3116 wrote to memory of 196	3116	regsvr32.exe	rundll32.exe
PID 3116 wrote to memory of 196	3116	regsvr32.exe	rundll32.exe
PID 3116 wrote to memory of 196	3116	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\12f1cb18016343fe5ec091c042b31668.exe
"C:\Users\Admin\AppData\Local\Temp\12f1cb18016343fe5ec091c042b31668.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\12F1CB~1.EXE@640
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL
MD5
27355eae89711b6f1b98fb24a0af60d3

SHA1
67bd1a0fb6f4898a182221340b90904668cc6f8e

SHA256
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f

SHA512
bd4da5763f415f99ddc2b0d4a34642d42da2ac3beac86bd50797841c2985391ba20da233e3513f7b7f6b98f946c2a7f0da2755645a3345c537fa7afc16696af3

Download Submit
memory/196-5-0x0000000000000000-mapping.dmp

Download
memory/640-1-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/3116-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads