danabot | 6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb

General

Target

6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe
Size

1011KB
MD5

e8e4a5dbac5a64dbe4b134ecd5732c4e
SHA1

eaa845953ff0fa95a1901c3630e51cef1c9c3edb
SHA256

6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb
SHA512

cbf46029ed65e8dfa9aa2c93b4e8879092dd5bdd02cf467408ce085631ec3d695342765865fb0dd656b2822cb438fe8dc4b7804c6010ad4db9d79e8464326370

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

5.61.58.130

2.56.213.39

5.61.56.192

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\6580B3~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL	family_danabot

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
5	1220	rundll32.exe
6	1220	rundll32.exe
7	1220	rundll32.exe
8	1220	rundll32.exe
9	1220	rundll32.exe
12	1220	rundll32.exe
13	1220	rundll32.exe
14	1220	rundll32.exe
15	1220	rundll32.exe
16	1220	rundll32.exe

Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1332 regsvr32.exe
1220 rundll32.exe
1220 rundll32.exe
1220 rundll32.exe
1220 rundll32.exe

pid	process
1332	regsvr32.exe
1220	rundll32.exe
1220	rundll32.exe
1220	rundll32.exe
1220	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exeregsvr32.exe

description	pid	process	target process
PID 1688 wrote to memory of 1332	1688	6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe	regsvr32.exe
PID 1688 wrote to memory of 1332	1688	6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe	regsvr32.exe
PID 1688 wrote to memory of 1332	1688	6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe	regsvr32.exe
PID 1688 wrote to memory of 1332	1688	6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe	regsvr32.exe
PID 1688 wrote to memory of 1332	1688	6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe	regsvr32.exe
PID 1688 wrote to memory of 1332	1688	6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe	regsvr32.exe
PID 1688 wrote to memory of 1332	1688	6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe	regsvr32.exe
PID 1332 wrote to memory of 1220	1332	regsvr32.exe	rundll32.exe
PID 1332 wrote to memory of 1220	1332	regsvr32.exe	rundll32.exe
PID 1332 wrote to memory of 1220	1332	regsvr32.exe	rundll32.exe
PID 1332 wrote to memory of 1220	1332	regsvr32.exe	rundll32.exe
PID 1332 wrote to memory of 1220	1332	regsvr32.exe	rundll32.exe
PID 1332 wrote to memory of 1220	1332	regsvr32.exe	rundll32.exe
PID 1332 wrote to memory of 1220	1332	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe
"C:\Users\Admin\AppData\Local\Temp\6580b317fa344c60c98d15f71a92fd9ca77d7431e4095a73cd8066510d938aeb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\6580B3~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\6580B3~1.EXE@1688
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6580B3~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6580B3~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
\Users\Admin\AppData\Local\Temp\6580B3~1.DLL
MD5
c94943c275e8b8884f0e32972578286e

SHA1
6bd23dfc427e8828af1e64d6fd48a1d8597c7c10

SHA256
cecea88f6f1203675dfc5b96de743b847c871e6a3e9f4ee83da5cfdbdd153026

SHA512
90ee602e74954175867f7f7e67834bff82bb6d8187874b591970e7dc5cbeeefaa912fed778689dd0102a8149ba639e3a7651bc4b2145f4fc4d7ddbf33fb053d4

Download Submit
memory/1220-67-0x0000000000000000-mapping.dmp

Download
memory/1220-73-0x0000000001C90000-0x0000000001D55000-memory.dmp

Filesize
788KB

Download
memory/1332-66-0x0000000000460000-0x0000000000525000-memory.dmp

Filesize
788KB

Download
memory/1332-63-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1332-62-0x0000000000000000-mapping.dmp

Download
memory/1688-60-0x0000000003110000-0x00000000031F5000-memory.dmp

Filesize
916KB

Download
memory/1688-61-0x0000000000400000-0x0000000002EB2000-memory.dmp

Filesize
42.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads