danabot | be62bd296d68f4ffcdb03f51859d8a10cab786435812842679e594564ebafe5f

Analysis

max time kernel
114s
max time network
117s
platform
windows10_x64
resource
win10-en-20210920
submitted
01/10/2021, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7927f5cb81ae68172215ab93c41f2b99.exe
Size 1.1MB
Sample211001-hkshlsbaf3
SHA256 be62bd296d68f4ffcdb03f51859d8a10cab786435812842679e594564ebafe5f
MD5 7927f5cb81ae68172215ab93c41f2b99
SHA1 e992cdf00c2eb2b44d001a2c7511b7768bc35554
SHA512 646cc464cfa74ef1778c0b071c650fddeac49cca74a0e2326a713bbbbda17ab7baa6754215b04225f40301b83631892930db18f82fd2b8bf4246664cd94bb84e
MD5 SHA1 SHA512

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

142.11.192.232:443
192.119.110.73:443
142.11.242.31:443
192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001abae-118.dat	DanabotLoader2021
behavioral2/files/0x000500000001abae-119.dat	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	2696	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2696	rundll32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\zohplghndapsm.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2696	2548	7927f5cb81ae68172215ab93c41f2b99.exe	70
PID 2548 wrote to memory of 2696	2548	7927f5cb81ae68172215ab93c41f2b99.exe	70
PID 2548 wrote to memory of 2696	2548	7927f5cb81ae68172215ab93c41f2b99.exe	70

C:\Users\Admin\AppData\Local\Temp\7927f5cb81ae68172215ab93c41f2b99.exe
"C:\Users\Admin\AppData\Local\Temp\7927f5cb81ae68172215ab93c41f2b99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7927F5~1.DLL,s C:\Users\Admin\AppData\Local\Temp\7927F5~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-115-0x0000000000E00000-0x0000000000F07000-memory.dmp

Download

memory/2548-116-0x0000000000400000-0x000000000094C000-memory.dmp