danabot | 00d10f9ac567b10c0ffd80fdd6f493cac120ab3cd2aa3ce58d05bfd73b4d11fb

General

Target

siri_active_1.exe
Size

2.6MB
MD5

45c235992028091065c4a3be6d409296
SHA1

c142417f014c9b2d28e7b6492de4ca6b3102ba26
SHA256

00d10f9ac567b10c0ffd80fdd6f493cac120ab3cd2aa3ce58d05bfd73b4d11fb
SHA512

c15575b32dce3707770d663aa5e797ccd10a5571369597c400bc09ede4dd14a33013dfcd8f652516394b2faef264a7dc48eb848a04cbf96313cfea14e656088f

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

92.204.160.126

193.34.166.26

93.115.22.159

93.115.22.165

185.227.138.52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 5 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4076 created 2484 4076 WerFault.exe siri_active_1.exe
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

9 3244 rundll32.exe
15 3244 rundll32.exe
16 3244 rundll32.exe
17 3244 rundll32.exe
18 3244 rundll32.exe
20 3244 rundll32.exe
21 3244 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3176 regsvr32.exe
3176 regsvr32.exe
3244 rundll32.exe
3244 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4076 2484 WerFault.exe siri_active_1.exe

description	pid	process	target process
PID 4076 created 2484	4076	WerFault.exe	siri_active_1.exe

flow	pid	process
9	3244	rundll32.exe
15	3244	rundll32.exe
16	3244	rundll32.exe
17	3244	rundll32.exe
18	3244	rundll32.exe
20	3244	rundll32.exe
21	3244	rundll32.exe

pid	process
3176	regsvr32.exe
3176	regsvr32.exe
3244	rundll32.exe
3244	rundll32.exe

pid	pid_target	process	target process
4076	2484	WerFault.exe	siri_active_1.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4076 WerFault.exe
Token: SeBackupPrivilege 4076 WerFault.exe
Token: SeDebugPrivilege 4076 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	4076	WerFault.exe
Token: SeBackupPrivilege	4076	WerFault.exe
Token: SeDebugPrivilege	4076	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

siri_active_1.exeregsvr32.exe

description	pid	process	target process
PID 2484 wrote to memory of 3176	2484	siri_active_1.exe	regsvr32.exe
PID 2484 wrote to memory of 3176	2484	siri_active_1.exe	regsvr32.exe
PID 2484 wrote to memory of 3176	2484	siri_active_1.exe	regsvr32.exe
PID 3176 wrote to memory of 3244	3176	regsvr32.exe	rundll32.exe
PID 3176 wrote to memory of 3244	3176	regsvr32.exe	rundll32.exe
PID 3176 wrote to memory of 3244	3176	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\siri_active_1.exe
"C:\Users\Admin\AppData\Local\Temp\siri_active_1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.EXE@2484
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 408
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
memory/2484-1-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/3176-2-0x0000000000000000-mapping.dmp

Download
memory/3244-9-0x0000000000000000-mapping.dmp

Download
memory/4076-3-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/4076-4-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/4076-12-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads