danabot | 2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc

General

Target

2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe
Size

1011KB
MD5

d45768ceae6cfdd8d41904340c72517a
SHA1

12062eca4bb9b412b8af3873d6224f5909153aaf
SHA256

2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc
SHA512

d2b91415aa026adebb126612a32cf6318af4289672d848016e19a301e40f8d28eb9dc477762270c098e936f10c2e07b1c31a497aeef5ecad7f338ee2cf1b86b5

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

5.61.58.130

2.56.213.39

5.61.56.192

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL	family_danabot

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
4	1248	rundll32.exe
7	1248	rundll32.exe
8	1248	rundll32.exe
9	1248	rundll32.exe
10	1248	rundll32.exe
11	1248	rundll32.exe
12	1248	rundll32.exe
13	1248	rundll32.exe
14	1248	rundll32.exe
15	1248	rundll32.exe

Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1280 regsvr32.exe
1248 rundll32.exe
1248 rundll32.exe
1248 rundll32.exe
1248 rundll32.exe

pid	process
1280	regsvr32.exe
1248	rundll32.exe
1248	rundll32.exe
1248	rundll32.exe
1248	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exeregsvr32.exe

description	pid	process	target process
PID 1676 wrote to memory of 1280	1676	2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe	regsvr32.exe
PID 1676 wrote to memory of 1280	1676	2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe	regsvr32.exe
PID 1676 wrote to memory of 1280	1676	2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe	regsvr32.exe
PID 1676 wrote to memory of 1280	1676	2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe	regsvr32.exe
PID 1676 wrote to memory of 1280	1676	2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe	regsvr32.exe
PID 1676 wrote to memory of 1280	1676	2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe	regsvr32.exe
PID 1676 wrote to memory of 1280	1676	2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe	regsvr32.exe
PID 1280 wrote to memory of 1248	1280	regsvr32.exe	rundll32.exe
PID 1280 wrote to memory of 1248	1280	regsvr32.exe	rundll32.exe
PID 1280 wrote to memory of 1248	1280	regsvr32.exe	rundll32.exe
PID 1280 wrote to memory of 1248	1280	regsvr32.exe	rundll32.exe
PID 1280 wrote to memory of 1248	1280	regsvr32.exe	rundll32.exe
PID 1280 wrote to memory of 1248	1280	regsvr32.exe	rundll32.exe
PID 1280 wrote to memory of 1248	1280	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe
"C:\Users\Admin\AppData\Local\Temp\2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\2A67F7~1.EXE@1676
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\2A67F7~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
memory/1248-72-0x0000000000720000-0x00000000007E5000-memory.dmp

Filesize
788KB

Download
memory/1248-66-0x0000000000000000-mapping.dmp

Download
memory/1280-62-0x0000000075971000-0x0000000075973000-memory.dmp

Filesize
8KB

Download
memory/1280-65-0x0000000000A90000-0x0000000000B55000-memory.dmp

Filesize
788KB

Download
memory/1280-61-0x0000000000000000-mapping.dmp

Download
memory/1676-59-0x0000000003160000-0x0000000003245000-memory.dmp

Filesize
916KB

Download
memory/1676-60-0x0000000000400000-0x0000000002EB2000-memory.dmp

Filesize
42.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads