danabot | 1c7b6dfdbd6117dd089c5e7df2dd6e61a36d1878dbe61e1c2d91f44da2da14fc

General

Target

siri_active_2.exe
Size

2.6MB
MD5

3d0756f3fa6d259adbddb73baf1fb23b
SHA1

2780840b4c4fd06e0a9fef8e6392aae3065b2e4d
SHA256

1c7b6dfdbd6117dd089c5e7df2dd6e61a36d1878dbe61e1c2d91f44da2da14fc
SHA512

4dccaa3913f7326e65e2e803af90bb799f2f5045245a10f382d9000186a93d1af1cd668d60f16ee27cef43bdc966efb67b7c844c58b9ec2829552327f6a56084

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

92.204.160.126

193.34.166.26

93.115.22.159

93.115.22.165

185.227.138.52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 5 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL	family_danabot

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3752 created 3976 3752 WerFault.exe siri_active_2.exe
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

17 3100 rundll32.exe
23 3100 rundll32.exe
24 3100 rundll32.exe
26 3100 rundll32.exe
27 3100 rundll32.exe
28 3100 rundll32.exe
29 3100 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1264 regsvr32.exe
1264 regsvr32.exe
3100 rundll32.exe
3100 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3752 3976 WerFault.exe siri_active_2.exe

description	pid	process	target process
PID 3752 created 3976	3752	WerFault.exe	siri_active_2.exe

flow	pid	process
17	3100	rundll32.exe
23	3100	rundll32.exe
24	3100	rundll32.exe
26	3100	rundll32.exe
27	3100	rundll32.exe
28	3100	rundll32.exe
29	3100	rundll32.exe

pid	process
1264	regsvr32.exe
1264	regsvr32.exe
3100	rundll32.exe
3100	rundll32.exe

pid	pid_target	process	target process
3752	3976	WerFault.exe	siri_active_2.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe
3752	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3752 WerFault.exe
Token: SeBackupPrivilege 3752 WerFault.exe
Token: SeDebugPrivilege 3752 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3752	WerFault.exe
Token: SeBackupPrivilege	3752	WerFault.exe
Token: SeDebugPrivilege	3752	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

siri_active_2.exeregsvr32.exe

description	pid	process	target process
PID 3976 wrote to memory of 1264	3976	siri_active_2.exe	regsvr32.exe
PID 3976 wrote to memory of 1264	3976	siri_active_2.exe	regsvr32.exe
PID 3976 wrote to memory of 1264	3976	siri_active_2.exe	regsvr32.exe
PID 1264 wrote to memory of 3100	1264	regsvr32.exe	rundll32.exe
PID 1264 wrote to memory of 3100	1264	regsvr32.exe	rundll32.exe
PID 1264 wrote to memory of 3100	1264	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\siri_active_2.exe
"C:\Users\Admin\AppData\Local\Temp\siri_active_2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3976

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.EXE@3976
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 396
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL
MD5
ba5bcacdd2930de8898da02eb76bd9d1

SHA1
2d6cdd794b651a92753113b58139957635efea7c

SHA256
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78

SHA512
b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27

Download Submit
memory/1264-2-0x0000000000000000-mapping.dmp

Download
memory/3100-9-0x0000000000000000-mapping.dmp

Download
memory/3752-6-0x0000000004470000-0x0000000004471000-memory.dmp

Filesize
4KB

Download
memory/3752-7-0x0000000004470000-0x0000000004471000-memory.dmp

Filesize
4KB

Download
memory/3752-13-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/3976-1-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads