danabot | 1ebddf22053d7670fc06fae9e4e2ff41cd48054f563ccab3c7561c6d1f989e91

Resubmissions

26-08-2021 15:28

26-08-2021 09:06

Target

tepserv.exe
Size

1.1MB
MD5

0884288b2df269ff9b34fddff3eb3208
SHA1

1480a8543b3c1fd4d26dc30fb60b8f9e1306aa0b
SHA256

1ebddf22053d7670fc06fae9e4e2ff41cd48054f563ccab3c7561c6d1f989e91
SHA512

f5ab8884eac60f2a4026b512491bde6cd8cd7df79f7d00c7f9dd8cbd1871ed5d981f7785481fa12446c217e4bed1ea7cc931a9d47dad5bd3ffa9c54db9c1320e

Score

10^/10

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 6 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130f0-65.dat	DanabotLoader2021
behavioral1/files/0x00040000000130f0-66.dat	DanabotLoader2021
behavioral1/files/0x00040000000130f0-68.dat	DanabotLoader2021
behavioral1/files/0x00040000000130f0-67.dat	DanabotLoader2021
behavioral1/files/0x00040000000130f0-69.dat	DanabotLoader2021
behavioral1/memory/300-70-0x00000000008E0000-0x0000000000A42000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	300	rundll32.exe

Loads dropped DLL 4 IoCs

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Gskyj.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 300	1836	tepserv.exe	29
PID 1836 wrote to memory of 300	1836	tepserv.exe	29
PID 1836 wrote to memory of 300	1836	tepserv.exe	29
PID 1836 wrote to memory of 300	1836	tepserv.exe	29
PID 1836 wrote to memory of 300	1836	tepserv.exe	29
PID 1836 wrote to memory of 300	1836	tepserv.exe	29
PID 1836 wrote to memory of 300	1836	tepserv.exe	29

C:\Users\Admin\AppData\Local\Temp\tepserv.exe
"C:\Users\Admin\AppData\Local\Temp\tepserv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\TEPSER~1.DLL,s C:\Users\Admin\AppData\Local\Temp\tepserv.exe
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:300

memory/300-70-0x00000000008E0000-0x0000000000A42000-memory.dmp

Filesize
1.4MB

Download
memory/1836-60-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1836-61-0x0000000004750000-0x0000000004856000-memory.dmp

Filesize
1.0MB

Download
memory/1836-62-0x0000000000400000-0x0000000002DA2000-memory.dmp

Filesize
41.6MB

Download