danabot | 9309025b86610fc4dade312f3681fa0e9370dcecca1563393fe4866d4e718d19

General

Target

b02c3131bf5fb12b3fae117632dc86ed.exe
Size

2.6MB
MD5

b02c3131bf5fb12b3fae117632dc86ed
SHA1

4fcc44307fa4c5826a7d33109917b3cb436722fd
SHA256

9309025b86610fc4dade312f3681fa0e9370dcecca1563393fe4866d4e718d19
SHA512

00c388778f35becdcbf0460b57cc5bedad70cdbf7872e9a3d1ce55d17a5690a3c5374e9610ba1c729e6e1a1574c4cfa27908904c18e3bd77438c78d2371d76dd

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

45.147.231.202

23.83.133.10

137.74.66.92

185.227.138.52

192.236.146.249

149.255.35.125

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\B02C31~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\B02C31~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\B02C31~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\B02C31~1.DLL	family_danabot

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow	pid	process
11	3644	rundll32.exe
15	3644	rundll32.exe
16	3644	rundll32.exe
18	3644	rundll32.exe
19	3644	rundll32.exe
20	3644	rundll32.exe
21	3644	rundll32.exe
22	3644	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3184 regsvr32.exe
3644 rundll32.exe
3644 rundll32.exe

pid	process
3184	regsvr32.exe
3644	rundll32.exe
3644	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b02c3131bf5fb12b3fae117632dc86ed.exeregsvr32.exe

description	pid	process	target process
PID 3980 wrote to memory of 3184	3980	b02c3131bf5fb12b3fae117632dc86ed.exe	regsvr32.exe
PID 3980 wrote to memory of 3184	3980	b02c3131bf5fb12b3fae117632dc86ed.exe	regsvr32.exe
PID 3980 wrote to memory of 3184	3980	b02c3131bf5fb12b3fae117632dc86ed.exe	regsvr32.exe
PID 3184 wrote to memory of 3644	3184	regsvr32.exe	rundll32.exe
PID 3184 wrote to memory of 3644	3184	regsvr32.exe	rundll32.exe
PID 3184 wrote to memory of 3644	3184	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\b02c3131bf5fb12b3fae117632dc86ed.exe
"C:\Users\Admin\AppData\Local\Temp\b02c3131bf5fb12b3fae117632dc86ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\B02C31~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\B02C31~1.EXE@3980
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\B02C31~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B02C31~1.DLL
MD5
414bc892169d57d097d7fc1a04da3624

SHA1
fbf48c2ea902de9e216032ec867561023220d577

SHA256
a1fcf4274e1f86fd689efc29859b6d4aef772915a9d346bc29c9e514b3b51798

SHA512
225dc50a998ccd05b8dad6800aeccbc13b91060d49cb0d9c37049ead538b00912f22ffbca55f670db93582356bb4199d969ded1a053f86157e512f3cc3e7e7ae

Download Submit
\Users\Admin\AppData\Local\Temp\B02C31~1.DLL
MD5
414bc892169d57d097d7fc1a04da3624

SHA1
fbf48c2ea902de9e216032ec867561023220d577

SHA256
a1fcf4274e1f86fd689efc29859b6d4aef772915a9d346bc29c9e514b3b51798

SHA512
225dc50a998ccd05b8dad6800aeccbc13b91060d49cb0d9c37049ead538b00912f22ffbca55f670db93582356bb4199d969ded1a053f86157e512f3cc3e7e7ae

Download Submit
\Users\Admin\AppData\Local\Temp\B02C31~1.DLL
MD5
414bc892169d57d097d7fc1a04da3624

SHA1
fbf48c2ea902de9e216032ec867561023220d577

SHA256
a1fcf4274e1f86fd689efc29859b6d4aef772915a9d346bc29c9e514b3b51798

SHA512
225dc50a998ccd05b8dad6800aeccbc13b91060d49cb0d9c37049ead538b00912f22ffbca55f670db93582356bb4199d969ded1a053f86157e512f3cc3e7e7ae

Download Submit
\Users\Admin\AppData\Local\Temp\B02C31~1.DLL
MD5
414bc892169d57d097d7fc1a04da3624

SHA1
fbf48c2ea902de9e216032ec867561023220d577

SHA256
a1fcf4274e1f86fd689efc29859b6d4aef772915a9d346bc29c9e514b3b51798

SHA512
225dc50a998ccd05b8dad6800aeccbc13b91060d49cb0d9c37049ead538b00912f22ffbca55f670db93582356bb4199d969ded1a053f86157e512f3cc3e7e7ae

Download Submit
memory/3184-2-0x0000000000000000-mapping.dmp

Download
memory/3644-5-0x0000000000000000-mapping.dmp

Download
memory/3980-1-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads