danabot | d84965a8eecfbc8c1bd466ecb91ffc30895a050c5b70fbba5beb30de498a30b4

Analysis

max time kernel
78s
max time network
108s
platform
windows7_x64
resource
win7-en-20210920
submitted
19/10/2021, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f15fa6ef37a36b927a274b88cb51a64.exe
Size 1.2MB
Sample211019-sdwa2aghhm
SHA256 d84965a8eecfbc8c1bd466ecb91ffc30895a050c5b70fbba5beb30de498a30b4
MD5 8f15fa6ef37a36b927a274b88cb51a64
SHA1 21eb4af9c3b796d7f10f6eb870143dea12856643
SHA512 d6753d33fdb0b0c353ab6155c42f470ba35a7d5b6659ef8cbcfeb440803c190dcfdda2ccd29fe44c55ab33b36be88fdb97b063e8e7de2424c049118fe06c7256
MD5 SHA1 SHA512

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

192.119.110.73:443
192.236.147.159:443
192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 6 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012275-60.dat	DanabotLoader2021
behavioral1/files/0x0007000000012275-62.dat	DanabotLoader2021
behavioral1/files/0x0007000000012275-63.dat	DanabotLoader2021
behavioral1/files/0x0007000000012275-64.dat	DanabotLoader2021
behavioral1/files/0x0007000000012275-61.dat	DanabotLoader2021
behavioral1/memory/1592-65-0x0000000000910000-0x0000000000A71000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1592	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\zohplghndapsm.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1592	1152	8f15fa6ef37a36b927a274b88cb51a64.exe	27
PID 1152 wrote to memory of 1592	1152	8f15fa6ef37a36b927a274b88cb51a64.exe	27
PID 1152 wrote to memory of 1592	1152	8f15fa6ef37a36b927a274b88cb51a64.exe	27
PID 1152 wrote to memory of 1592	1152	8f15fa6ef37a36b927a274b88cb51a64.exe	27
PID 1152 wrote to memory of 1592	1152	8f15fa6ef37a36b927a274b88cb51a64.exe	27
PID 1152 wrote to memory of 1592	1152	8f15fa6ef37a36b927a274b88cb51a64.exe	27
PID 1152 wrote to memory of 1592	1152	8f15fa6ef37a36b927a274b88cb51a64.exe	27

C:\Users\Admin\AppData\Local\Temp\8f15fa6ef37a36b927a274b88cb51a64.exe
"C:\Users\Admin\AppData\Local\Temp\8f15fa6ef37a36b927a274b88cb51a64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\8F15FA~1.DLL,s C:\Users\Admin\AppData\Local\Temp\8F15FA~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:1592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-54-0x0000000003260000-0x000000000334E000-memory.dmp

Download

memory/1152-56-0x0000000000400000-0x0000000002FF1000-memory.dmp

Download

memory/1152-55-0x0000000003540000-0x0000000003645000-memory.dmp

Download

memory/1152-57-0x00000000767F1000-0x00000000767F3000-memory.dmp

Download

memory/1592-65-0x0000000000910000-0x0000000000A71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads