danabot | 1ebddf22053d7670fc06fae9e4e2ff41cd48054f563ccab3c7561c6d1f989e91

Resubmissions

26-08-2021 15:28

210826-blwj5wwjsn 10

26-08-2021 09:06

210826-ae6ksmbjc2 10

Analysis

max time kernel
163s
max time network
167s
platform
windows10_x64
resource
win10v20210408
submitted
26-08-2021 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tepserv.exe
Size

1.1MB
MD5

0884288b2df269ff9b34fddff3eb3208
SHA1

1480a8543b3c1fd4d26dc30fb60b8f9e1306aa0b
SHA256

1ebddf22053d7670fc06fae9e4e2ff41cd48054f563ccab3c7561c6d1f989e91
SHA512

f5ab8884eac60f2a4026b512491bde6cd8cd7df79f7d00c7f9dd8cbd1871ed5d981f7785481fa12446c217e4bed1ea7cc931a9d47dad5bd3ffa9c54db9c1320e

Score

10^/10

danabot banker discovery trojan

Malware Config

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 5 IoCs

resource	yara_rule
behavioral2/files/0x000200000001ab55-117.dat	DanabotLoader2021
behavioral2/files/0x000200000001ab55-118.dat	DanabotLoader2021
behavioral2/files/0x000200000001ab55-119.dat	DanabotLoader2021
behavioral2/memory/2304-120-0x0000000000730000-0x0000000000892000-memory.dmp	DanabotLoader2021
behavioral2/files/0x000200000001ab55-129.dat	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
11	2304	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
2304	rundll32.exe
2304	rundll32.exe
4016	RUNDLL32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Gskyj.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 2304	652	tepserv.exe	78
PID 652 wrote to memory of 2304	652	tepserv.exe	78
PID 652 wrote to memory of 2304	652	tepserv.exe	78
PID 2304 wrote to memory of 4016	2304	rundll32.exe	79
PID 2304 wrote to memory of 4016	2304	rundll32.exe	79
PID 2304 wrote to memory of 4016	2304	rundll32.exe	79

C:\Users\Admin\AppData\Local\Temp\tepserv.exe
"C:\Users\Admin\AppData\Local\Temp\tepserv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL,s C:\Users\Admin\AppData\Local\Temp\tepserv.exe
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\RUNDLL32.EXE
    C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL,sl1VOHY0Qg==
    3⤵
    - Loads dropped DLL
    PID:4016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-114-0x0000000004CA0000-0x0000000004DA6000-memory.dmp

Filesize
1.0MB

Download
memory/652-115-0x0000000000400000-0x0000000002DA2000-memory.dmp

Filesize
41.6MB

Download
memory/2304-120-0x0000000000730000-0x0000000000892000-memory.dmp

Filesize
1.4MB

Download
memory/2304-121-0x0000000005B80000-0x0000000005B81000-memory.dmp

Filesize
4KB

Download
memory/2304-127-0x0000000004650000-0x00000000058E8000-memory.dmp

Filesize
18.6MB

Download