danabot | c0649c8956c5aaeb5bfa30603bc6d7fab612c4150d4b5e207a494c3a263dcfb6

Analysis

max time kernel
106s
max time network
11s
platform
windows7_x64
resource
win7v20210410
submitted
17-06-2021 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5030000.dll
Size

5.3MB
MD5

759bd4d10c8dd1dbf501e563a67806a9
SHA1

072ed6ee7cdbee79992be058ce73c82727fa6dec
SHA256

c0649c8956c5aaeb5bfa30603bc6d7fab612c4150d4b5e207a494c3a263dcfb6
SHA512

ca770f56b966768892dc0fcf1f63cb5d4fc65f18e2cd80ff871bec38bdbeec221a07dbc24b486322b5aee1935ffac515a48c53bb7c393abbfe9ac2a62e5f760e

Score

10^/10

danabot 3 banker trojan

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

184.95.51.183:443

184.95.51.175:443

192.210.198.12:443

184.95.51.180:443

Attributes

embedded_hash
AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1640 1492 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1640 WerFault.exe
1640 WerFault.exe
1640 WerFault.exe
1640 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1640 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1640 WerFault.exe

pid	pid_target	process	target process
1640	1492	WerFault.exe	rundll32.exe

pid	process
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe

pid	process
1640	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1640	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 1492	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1492	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1492	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1492	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1492	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1492	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1492	2040	rundll32.exe	rundll32.exe
PID 1492 wrote to memory of 1640	1492	rundll32.exe	WerFault.exe
PID 1492 wrote to memory of 1640	1492	rundll32.exe	WerFault.exe
PID 1492 wrote to memory of 1640	1492	rundll32.exe	WerFault.exe
PID 1492 wrote to memory of 1640	1492	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5030000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5030000.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 264
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1640

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-60-0x0000000000000000-mapping.dmp

Download
memory/1492-61-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download
memory/1492-62-0x0000000002170000-0x00000000027D0000-memory.dmp

Filesize
6.4MB

Download
memory/1640-63-0x0000000000000000-mapping.dmp

Download
memory/1640-64-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download