danabot | dc8ecedc327784cd97120e221c7d85cad5ce6447ab181af99e71426117a5ea50

Analysis

max time kernel
78s
max time network
118s
platform
windows10_x64
resource
win10v20210410
submitted
09/08/2021, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c07f8b98e61d202f586fe4cf3b8b6aab.exe
Size 1.1MB
Sample210809-5mqkph35ma
SHA256 dc8ecedc327784cd97120e221c7d85cad5ce6447ab181af99e71426117a5ea50
MD5 c07f8b98e61d202f586fe4cf3b8b6aab
SHA1 7798520b8e329d29652878dbacf54eab780adde9
SHA512 51b138c0b7f29a0fd2191d23da0e1c60fc1b4ba5c81d300b4ab12d7bfe5eca77fe253cb81213adf2f227ab852ee9afbf50e626c9a74a1d3671e4fd4f08951004
MD5 SHA1 SHA512

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

142.11.244.124:443
142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral2/files/0x000200000001ab37-115.dat	DanabotLoader2021
behavioral2/files/0x000200000001ab37-116.dat	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
15	4976	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4976	rundll32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Jvgzbfh.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4976	4436	c07f8b98e61d202f586fe4cf3b8b6aab.exe	76
PID 4436 wrote to memory of 4976	4436	c07f8b98e61d202f586fe4cf3b8b6aab.exe	76
PID 4436 wrote to memory of 4976	4436	c07f8b98e61d202f586fe4cf3b8b6aab.exe	76

C:\Users\Admin\AppData\Local\Temp\c07f8b98e61d202f586fe4cf3b8b6aab.exe
"C:\Users\Admin\AppData\Local\Temp\c07f8b98e61d202f586fe4cf3b8b6aab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\C07F8B~1.TMP,S C:\Users\Admin\AppData\Local\Temp\C07F8B~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4436-118-0x0000000000400000-0x0000000002D4E000-memory.dmp

Download

memory/4436-117-0x0000000004B60000-0x0000000004C5D000-memory.dmp