danabot | b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2

General

Target

b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe
Size

1.8MB
MD5

b9c577e188a9123ce81a75b1a88123a1
SHA1

dc4f1e4b46bec55ea693d904480708d0518005c0
SHA256

b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2
SHA512

e60bbc5ee432f1b3548101937664113b75ad75bdd1ca0539672db71cf1169ec7410b9f75f57d248bce5f4b37c6c8905b40495b2bcb94599979747dca3eae964b

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

C2

192.119.110.73:443

192.236.192.201:443

Attributes

embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\B32487~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\B32487~1.DLL	DanabotLoader2021

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2836 created 3288 2836 WerFault.exe b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3776 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2836 3288 WerFault.exe b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe

description	pid	process	target process
PID 2836 created 3288	2836	WerFault.exe	b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe

pid	process
3776	rundll32.exe

pid	pid_target	process	target process
2836	3288	WerFault.exe	b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2836 WerFault.exe
Token: SeBackupPrivilege 2836 WerFault.exe
Token: SeDebugPrivilege 2836 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2836	WerFault.exe
Token: SeBackupPrivilege	2836	WerFault.exe
Token: SeDebugPrivilege	2836	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe

description	pid	process	target process
PID 3288 wrote to memory of 3776	3288	b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe	rundll32.exe
PID 3288 wrote to memory of 3776	3288	b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe	rundll32.exe
PID 3288 wrote to memory of 3776	3288	b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe
"C:\Users\Admin\AppData\Local\Temp\b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\B32487~1.DLL,s C:\Users\Admin\AppData\Local\Temp\B32487~1.EXE
  2⤵
  - Loads dropped DLL
  PID:3776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 576
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B32487~1.DLL

MD5
6f6b26b963987fef06ae1bb096f00650

SHA1
a743978cada038137cceeb2a4e9ce57ebb391a17

SHA256
130ae0a3e9cecf98e158b181f883294e262aa621ec2ec58008b1008a04dd91c5

SHA512
06aa1bb6ea1593a3faba0ffbdfd2f1f26992b33daeb3d2b3cd2dcce37d5c8777b1dfa7f0c1987dffd0a3cfe96b53f9f7024ae51e867aa84ad5ee50a7752a98cc

Download Submit
\Users\Admin\AppData\Local\Temp\B32487~1.DLL

MD5
6f6b26b963987fef06ae1bb096f00650

SHA1
a743978cada038137cceeb2a4e9ce57ebb391a17

SHA256
130ae0a3e9cecf98e158b181f883294e262aa621ec2ec58008b1008a04dd91c5

SHA512
06aa1bb6ea1593a3faba0ffbdfd2f1f26992b33daeb3d2b3cd2dcce37d5c8777b1dfa7f0c1987dffd0a3cfe96b53f9f7024ae51e867aa84ad5ee50a7752a98cc

Download Submit
memory/3288-115-0x0000000002F6A000-0x00000000030FA000-memory.dmp

Filesize
1.6MB

Download
memory/3288-116-0x0000000003100000-0x00000000032A7000-memory.dmp

Filesize
1.7MB

Download
memory/3288-117-0x0000000000400000-0x0000000001207000-memory.dmp

Filesize
14.0MB

Download
memory/3776-118-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads