danabot | dec76ba0a613b70fe6a85f8eef108ca0df5ff8b024ecb0d1fec5294715ff5b8a

Analysis

max time kernel
139s
max time network
142s
platform
windows10_x64
resource
win10-en-20211104
submitted
28/11/2021, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38b6967e601ce8fe3006082d82d53388.exe
Size 1.8MB
Sample211128-1dmb5adga3
SHA256 dec76ba0a613b70fe6a85f8eef108ca0df5ff8b024ecb0d1fec5294715ff5b8a
MD5 38b6967e601ce8fe3006082d82d53388
SHA1 d0f86a7b2876a022f12c647e89cfe4cabf03288b
SHA512 832e10fa48c088df91b88330e9e35a708069e8768ab4b2f339431d640ddf9781e1c7ac9e8382c5cf33d900eb8a966a5d09f738694405ddd420d827ae87748c31
MD5 SHA1 SHA512

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

142.11.244.223:443
23.106.122.139:443

Attributes

embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

resource	yara_rule
behavioral2/files/0x000400000001ab7e-122.dat	DanabotLoader2021
behavioral2/files/0x000400000001ab7e-124.dat	DanabotLoader2021
behavioral2/files/0x000400000001ab7e-123.dat	DanabotLoader2021
behavioral2/memory/684-125-0x0000000003FF0000-0x0000000004268000-memory.dmp	DanabotLoader2021

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 404 created 2760	404	WerFault.exe	67

Loads dropped DLL 2 IoCs

pid	Process
684	rundll32.exe
684	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
404	2760	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe
404	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	404	WerFault.exe
Token: SeBackupPrivilege	404	WerFault.exe
Token: SeDebugPrivilege	404	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 684	2760	38b6967e601ce8fe3006082d82d53388.exe	69
PID 2760 wrote to memory of 684	2760	38b6967e601ce8fe3006082d82d53388.exe	69
PID 2760 wrote to memory of 684	2760	38b6967e601ce8fe3006082d82d53388.exe	69

C:\Users\Admin\AppData\Local\Temp\38b6967e601ce8fe3006082d82d53388.exe
"C:\Users\Admin\AppData\Local\Temp\38b6967e601ce8fe3006082d82d53388.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\38B696~1.DLL,s C:\Users\Admin\AppData\Local\Temp\38B696~1.EXE
  2⤵
  - Loads dropped DLL
  PID:684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 560
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-125-0x0000000003FF0000-0x0000000004268000-memory.dmp

Download

memory/2760-118-0x000000000398E000-0x0000000003B1A000-memory.dmp

Download

memory/2760-119-0x0000000003B20000-0x0000000003CC3000-memory.dmp

Download

memory/2760-120-0x0000000000400000-0x00000000033AA000-memory.dmp

Download