danabot | 2a948b38ca5257d8347b66757eb01d8df2d91c41ae08535706be17f9d9c5f956

Analysis

max time kernel
93s
max time network
95s
platform
windows7_x64
resource
win7v20210408
submitted
03/10/2021, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
331fd56e84657a3edb69e439fe843f54.exe
Size 1.2MB
Sample211003-twypjsffcp
SHA256 2a948b38ca5257d8347b66757eb01d8df2d91c41ae08535706be17f9d9c5f956
MD5 331fd56e84657a3edb69e439fe843f54
SHA1 33b09d8351033603c61e014fcbabced80b0e192c
SHA512 057eacfe2c0d6803dd27de7ba403a47236d20807bb896bfcf56470bb52f97b76ab1f640a1bf1dc1d7c6d4e6f8793590f74ac504cf683b478b3037d5585c06448
MD5 SHA1 SHA512

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

142.11.192.232:443
192.119.110.73:443
142.11.242.31:443
192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 6 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130b6-65.dat	DanabotLoader2021
behavioral1/files/0x00040000000130b6-67.dat	DanabotLoader2021
behavioral1/files/0x00040000000130b6-69.dat	DanabotLoader2021
behavioral1/files/0x00040000000130b6-68.dat	DanabotLoader2021
behavioral1/memory/1088-70-0x0000000001CC0000-0x0000000001E22000-memory.dmp	DanabotLoader2021
behavioral1/files/0x00040000000130b6-66.dat	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1088	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
1088	rundll32.exe
1088	rundll32.exe
1088	rundll32.exe
1088	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1088	1684	331fd56e84657a3edb69e439fe843f54.exe	25
PID 1684 wrote to memory of 1088	1684	331fd56e84657a3edb69e439fe843f54.exe	25
PID 1684 wrote to memory of 1088	1684	331fd56e84657a3edb69e439fe843f54.exe	25
PID 1684 wrote to memory of 1088	1684	331fd56e84657a3edb69e439fe843f54.exe	25
PID 1684 wrote to memory of 1088	1684	331fd56e84657a3edb69e439fe843f54.exe	25
PID 1684 wrote to memory of 1088	1684	331fd56e84657a3edb69e439fe843f54.exe	25
PID 1684 wrote to memory of 1088	1684	331fd56e84657a3edb69e439fe843f54.exe	25

C:\Users\Admin\AppData\Local\Temp\331fd56e84657a3edb69e439fe843f54.exe
"C:\Users\Admin\AppData\Local\Temp\331fd56e84657a3edb69e439fe843f54.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\331FD5~1.DLL,s C:\Users\Admin\AppData\Local\Temp\331FD5~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-70-0x0000000001CC0000-0x0000000001E22000-memory.dmp

Download

memory/1684-60-0x0000000075B31000-0x0000000075B33000-memory.dmp

Download

memory/1684-61-0x0000000000750000-0x0000000000856000-memory.dmp

Download

memory/1684-62-0x0000000000400000-0x000000000053B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads