danabot | f4ece2e087a027df893f9575d2ca71102e96ad1048ce54727cccfff810343b18

General

Target

f4ece2e087a027df893f9575d2ca71102e96ad1048ce54727cccfff810343b18.exe
Size

1.0MB
MD5

60f54b040dacc7d25f7b4f19939669df
SHA1

1220b332ca4bca3255b1511c98a21394996d49ba
SHA256

f4ece2e087a027df893f9575d2ca71102e96ad1048ce54727cccfff810343b18
SHA512

7fdd04fbdc195fff2fcd03d9110803d223c22274e79482f3a2fa54f5c7253b3dc67cc720bde5b1659a569eda6dc08cacf1d3904a91da0f70b5bc4c5f8923f63f

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

5.61.58.130

2.56.213.39

5.61.56.192

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL	family_danabot

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
25	2648	rundll32.exe
26	2648	rundll32.exe
27	2648	rundll32.exe
28	2648	rundll32.exe
29	2648	rundll32.exe
30	2648	rundll32.exe
31	2648	rundll32.exe
35	2648	rundll32.exe
36	2648	rundll32.exe
37	2648	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

940 regsvr32.exe
2648 rundll32.exe
2648 rundll32.exe

pid	process
940	regsvr32.exe
2648	rundll32.exe
2648	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f4ece2e087a027df893f9575d2ca71102e96ad1048ce54727cccfff810343b18.exeregsvr32.exe

description	pid	process	target process
PID 3724 wrote to memory of 940	3724	f4ece2e087a027df893f9575d2ca71102e96ad1048ce54727cccfff810343b18.exe	regsvr32.exe
PID 3724 wrote to memory of 940	3724	f4ece2e087a027df893f9575d2ca71102e96ad1048ce54727cccfff810343b18.exe	regsvr32.exe
PID 3724 wrote to memory of 940	3724	f4ece2e087a027df893f9575d2ca71102e96ad1048ce54727cccfff810343b18.exe	regsvr32.exe
PID 940 wrote to memory of 2648	940	regsvr32.exe	rundll32.exe
PID 940 wrote to memory of 2648	940	regsvr32.exe	rundll32.exe
PID 940 wrote to memory of 2648	940	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\f4ece2e087a027df893f9575d2ca71102e96ad1048ce54727cccfff810343b18.exe
"C:\Users\Admin\AppData\Local\Temp\f4ece2e087a027df893f9575d2ca71102e96ad1048ce54727cccfff810343b18.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\F4ECE2~1.EXE@3724
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL
MD5
e247935e894ba4e3bfc66898e2435a56

SHA1
d5485bbde30b97b8c5ffafaab97038c9bba04fd9

SHA256
fbaf207c12fcdfff24275a382205de52d304e506240ac6ca2aa7a3cfc0d4be09

SHA512
fe7a557e3a1de0daf89250daf3508f3ed01fab559548af36f202f9c14e9fdbbe10621317da2af7f3a5d27517be2185497151f337854a0a05be137d15dfa39a98

Download Submit
\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL
MD5
e247935e894ba4e3bfc66898e2435a56

SHA1
d5485bbde30b97b8c5ffafaab97038c9bba04fd9

SHA256
fbaf207c12fcdfff24275a382205de52d304e506240ac6ca2aa7a3cfc0d4be09

SHA512
fe7a557e3a1de0daf89250daf3508f3ed01fab559548af36f202f9c14e9fdbbe10621317da2af7f3a5d27517be2185497151f337854a0a05be137d15dfa39a98

Download Submit
\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL
MD5
e247935e894ba4e3bfc66898e2435a56

SHA1
d5485bbde30b97b8c5ffafaab97038c9bba04fd9

SHA256
fbaf207c12fcdfff24275a382205de52d304e506240ac6ca2aa7a3cfc0d4be09

SHA512
fe7a557e3a1de0daf89250daf3508f3ed01fab559548af36f202f9c14e9fdbbe10621317da2af7f3a5d27517be2185497151f337854a0a05be137d15dfa39a98

Download Submit
\Users\Admin\AppData\Local\Temp\F4ECE2~1.DLL
MD5
e247935e894ba4e3bfc66898e2435a56

SHA1
d5485bbde30b97b8c5ffafaab97038c9bba04fd9

SHA256
fbaf207c12fcdfff24275a382205de52d304e506240ac6ca2aa7a3cfc0d4be09

SHA512
fe7a557e3a1de0daf89250daf3508f3ed01fab559548af36f202f9c14e9fdbbe10621317da2af7f3a5d27517be2185497151f337854a0a05be137d15dfa39a98

Download Submit
memory/940-116-0x0000000000000000-mapping.dmp

Download
memory/2648-119-0x0000000000000000-mapping.dmp

Download
memory/2648-122-0x0000000004140000-0x0000000004202000-memory.dmp

Filesize
776KB

Download
memory/3724-114-0x0000000000860000-0x0000000000940000-memory.dmp

Filesize
896KB

Download
memory/3724-115-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads