danabot | 1ebddf22053d7670fc06fae9e4e2ff41cd48054f563ccab3c7561c6d1f989e91

General

Target

tepserv.exe
Size

1.1MB
MD5

0884288b2df269ff9b34fddff3eb3208
SHA1

1480a8543b3c1fd4d26dc30fb60b8f9e1306aa0b
SHA256

1ebddf22053d7670fc06fae9e4e2ff41cd48054f563ccab3c7561c6d1f989e91
SHA512

f5ab8884eac60f2a4026b512491bde6cd8cd7df79f7d00c7f9dd8cbd1871ed5d981f7785481fa12446c217e4bed1ea7cc931a9d47dad5bd3ffa9c54db9c1320e

Score

10^/10

danabot banker discovery trojan

Malware Config

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL	DanabotLoader2021
behavioral2/memory/2304-120-0x0000000000730000-0x0000000000892000-memory.dmp	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

11 2304 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

rundll32.exeRUNDLL32.EXE

pid process

2304 rundll32.exe
2304 rundll32.exe
4016 RUNDLL32.EXE
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Program Files directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\PROGRA~3\Gskyj.tmp rundll32.exe

flow	pid	process
11	2304	rundll32.exe

pid	process
2304	rundll32.exe
2304	rundll32.exe
4016	RUNDLL32.EXE

description	ioc	process
File created	C:\PROGRA~3\Gskyj.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

tepserv.exerundll32.exe

description	pid	process	target process
PID 652 wrote to memory of 2304	652	tepserv.exe	rundll32.exe
PID 652 wrote to memory of 2304	652	tepserv.exe	rundll32.exe
PID 652 wrote to memory of 2304	652	tepserv.exe	rundll32.exe
PID 2304 wrote to memory of 4016	2304	rundll32.exe	RUNDLL32.EXE
PID 2304 wrote to memory of 4016	2304	rundll32.exe	RUNDLL32.EXE
PID 2304 wrote to memory of 4016	2304	rundll32.exe	RUNDLL32.EXE

C:\Users\Admin\AppData\Local\Temp\tepserv.exe
"C:\Users\Admin\AppData\Local\Temp\tepserv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL,s C:\Users\Admin\AppData\Local\Temp\tepserv.exe
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2304

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL,sl1VOHY0Qg==
3⤵
- Loads dropped DLL
PID:4016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Gskyj.tmp
MD5
1dbb4568625d2862d91483afb488ed9c

SHA1
34294efd328ec332359fe59d1f0d2671f584a8ab

SHA256
e7e2d08c9d6d5a3559e6bdc634f1b74f22dca17b752eea1abdda12d6b3fa7365

SHA512
6d1315aa061c30447e2edbf02a87b9142866db6f24a13e7a0b5e2ce5e07389c12854983e3d1b475420458f4357611ce8e103004e637be3527b9e4f042cea63c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL
MD5
b3e7a4a3c414d4eae7fc81007c581d8a

SHA1
e6d115b949c7fffc4f770c7b681ea22fa1e4d736

SHA256
928ec5be3ed1ad12a920186c3315754a9a2e905fab409f6ab87fd721fc4bc065

SHA512
727c700efbba54b4ced1ab0f32059de486d32db4285564576bfc35c02cd543f9426e624b65cd6ac461c1898bd009c0ff48f9f9eb5d33e0a6d7372588b4793035

Download Submit
\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL
MD5
b3e7a4a3c414d4eae7fc81007c581d8a

SHA1
e6d115b949c7fffc4f770c7b681ea22fa1e4d736

SHA256
928ec5be3ed1ad12a920186c3315754a9a2e905fab409f6ab87fd721fc4bc065

SHA512
727c700efbba54b4ced1ab0f32059de486d32db4285564576bfc35c02cd543f9426e624b65cd6ac461c1898bd009c0ff48f9f9eb5d33e0a6d7372588b4793035

Download Submit
\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL
MD5
b3e7a4a3c414d4eae7fc81007c581d8a

SHA1
e6d115b949c7fffc4f770c7b681ea22fa1e4d736

SHA256
928ec5be3ed1ad12a920186c3315754a9a2e905fab409f6ab87fd721fc4bc065

SHA512
727c700efbba54b4ced1ab0f32059de486d32db4285564576bfc35c02cd543f9426e624b65cd6ac461c1898bd009c0ff48f9f9eb5d33e0a6d7372588b4793035

Download Submit
\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL
MD5
b3e7a4a3c414d4eae7fc81007c581d8a

SHA1
e6d115b949c7fffc4f770c7b681ea22fa1e4d736

SHA256
928ec5be3ed1ad12a920186c3315754a9a2e905fab409f6ab87fd721fc4bc065

SHA512
727c700efbba54b4ced1ab0f32059de486d32db4285564576bfc35c02cd543f9426e624b65cd6ac461c1898bd009c0ff48f9f9eb5d33e0a6d7372588b4793035

Download Submit
memory/652-114-0x0000000004CA0000-0x0000000004DA6000-memory.dmp

Filesize
1.0MB

Download
memory/652-115-0x0000000000400000-0x0000000002DA2000-memory.dmp

Filesize
41.6MB

Download
memory/2304-116-0x0000000000000000-mapping.dmp

Download
memory/2304-120-0x0000000000730000-0x0000000000892000-memory.dmp

Filesize
1.4MB

Download
memory/2304-121-0x0000000005B80000-0x0000000005B81000-memory.dmp

Filesize
4KB

Download
memory/2304-127-0x0000000004650000-0x00000000058E8000-memory.dmp

Filesize
18.6MB

Download
memory/4016-128-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing