danabot | c0649c8956c5aaeb5bfa30603bc6d7fab612c4150d4b5e207a494c3a263dcfb6

Analysis

max time kernel
14s
max time network
76s
platform
windows10_x64
resource
win10v20210408
submitted
17-06-2021 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5030000.dll
Size

5.3MB
MD5

759bd4d10c8dd1dbf501e563a67806a9
SHA1

072ed6ee7cdbee79992be058ce73c82727fa6dec
SHA256

c0649c8956c5aaeb5bfa30603bc6d7fab612c4150d4b5e207a494c3a263dcfb6
SHA512

ca770f56b966768892dc0fcf1f63cb5d4fc65f18e2cd80ff871bec38bdbeec221a07dbc24b486322b5aee1935ffac515a48c53bb7c393abbfe9ac2a62e5f760e

Score

10^/10

danabot 3 banker trojan

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

184.95.51.183:443

184.95.51.175:443

192.210.198.12:443

184.95.51.180:443

Attributes

embedded_hash
AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4064 1636 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4064	1636	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4064 WerFault.exe
Token: SeBackupPrivilege 4064 WerFault.exe
Token: SeDebugPrivilege 4064 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	4064	WerFault.exe
Token: SeBackupPrivilege	4064	WerFault.exe
Token: SeDebugPrivilege	4064	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 808 wrote to memory of 1636	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 1636	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 1636	808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5030000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5030000.dll,#1
2⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 664
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-114-0x0000000000000000-mapping.dmp

Download
memory/1636-115-0x00000000043D0000-0x0000000004A30000-memory.dmp

Filesize
6.4MB

Download