danabot | af0b53ecd547b0a629164b818d8562a5b6c3a3c15d89a764fcdc87cf0f6d4489

General

Target

a3cc8671b3e2367103fed24a2443907b.exe
Size

1.1MB
MD5

a3cc8671b3e2367103fed24a2443907b
SHA1

8819033faeb0f3cbad1cb7b5da9c1dfc7451554b
SHA256

af0b53ecd547b0a629164b818d8562a5b6c3a3c15d89a764fcdc87cf0f6d4489
SHA512

a33d13a88c5b75074d8cb40184134abdf57a4433b30a2bd9cf4f2755dfb7ef5d61aada867c9dfc9085cfb882c1f247a0559befbe96b67f8d27cd996b016f0b4d

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

2.56.213.39

185.238.168.83

185.238.168.174

93.115.20.189

93.115.20.183

5.61.58.130

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL	family_danabot

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

10 3636 rundll32.exe
14 3636 rundll32.exe
15 3636 rundll32.exe
16 3636 rundll32.exe
17 3636 rundll32.exe
18 3636 rundll32.exe
19 3636 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3408 regsvr32.exe
3408 regsvr32.exe
3636 rundll32.exe

flow	pid	process
10	3636	rundll32.exe
14	3636	rundll32.exe
15	3636	rundll32.exe
16	3636	rundll32.exe
17	3636	rundll32.exe
18	3636	rundll32.exe
19	3636	rundll32.exe

pid	process
3408	regsvr32.exe
3408	regsvr32.exe
3636	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a3cc8671b3e2367103fed24a2443907b.exeregsvr32.exe

description	pid	process	target process
PID 1108 wrote to memory of 3408	1108	a3cc8671b3e2367103fed24a2443907b.exe	regsvr32.exe
PID 1108 wrote to memory of 3408	1108	a3cc8671b3e2367103fed24a2443907b.exe	regsvr32.exe
PID 1108 wrote to memory of 3408	1108	a3cc8671b3e2367103fed24a2443907b.exe	regsvr32.exe
PID 3408 wrote to memory of 3636	3408	regsvr32.exe	rundll32.exe
PID 3408 wrote to memory of 3636	3408	regsvr32.exe	rundll32.exe
PID 3408 wrote to memory of 3636	3408	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a3cc8671b3e2367103fed24a2443907b.exe
"C:\Users\Admin\AppData\Local\Temp\a3cc8671b3e2367103fed24a2443907b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\A3CC86~1.EXE@1108
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL
MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL
MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL
MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
\Users\Admin\AppData\Local\Temp\A3CC86~1.DLL
MD5
2241bb9c3b3c4ffe7f91adf27a005d8a

SHA1
4623329adb367ed0977fd94b7bca991424103a64

SHA256
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d

SHA512
cd23a9fba54e7720a4aad50cfe8bf7e3cc99282ac73b085e725428992f0c8f86c76938dbaff74e2a7f0b64051a02a2d78a4f82560f78c3ec18961261c08a3697

Download Submit
memory/1108-1-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3408-2-0x0000000000000000-mapping.dmp

Download
memory/3636-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing