danabot | 5d48b2614aaaebab4a97deafbd3117e2baa62aaf6a357003b10554e3caa60f5a

Analysis

max time kernel
100s
max time network
110s
platform
windows10_x64
resource
win10-en-20210920
submitted
03/10/2021, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2bce3c8efb3cb62fe2537ba2ff92030a.exe
Size 1.2MB
Sample211003-jczsdsfcam
SHA256 5d48b2614aaaebab4a97deafbd3117e2baa62aaf6a357003b10554e3caa60f5a
MD5 2bce3c8efb3cb62fe2537ba2ff92030a
SHA1 426d0806320d005938fc7c698291bd6b9cca46ea
SHA512 b7ef3bf8fdbf0cd3b787e40d36655777f28f0d5b4005cb161b604dba179dd983c13eff90dc818a1b2f05495dd555038a9f4535590f5eada932a08a0d45d9e8c3
MD5 SHA1 SHA512

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

142.11.192.232:443
192.119.110.73:443
142.11.242.31:443
192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab79-116.dat	DanabotLoader2021
behavioral2/files/0x000500000001ab79-117.dat	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	4164	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4164	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4164	3608	2bce3c8efb3cb62fe2537ba2ff92030a.exe	70
PID 3608 wrote to memory of 4164	3608	2bce3c8efb3cb62fe2537ba2ff92030a.exe	70
PID 3608 wrote to memory of 4164	3608	2bce3c8efb3cb62fe2537ba2ff92030a.exe	70

C:\Users\Admin\AppData\Local\Temp\2bce3c8efb3cb62fe2537ba2ff92030a.exe
"C:\Users\Admin\AppData\Local\Temp\2bce3c8efb3cb62fe2537ba2ff92030a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2BCE3C~1.DLL,s C:\Users\Admin\AppData\Local\Temp\2BCE3C~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:4164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3608-118-0x0000000000910000-0x0000000000A16000-memory.dmp

Download

memory/3608-119-0x0000000000400000-0x000000000053E000-memory.dmp