danabot | 811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8

General

Target

811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe
Size

1.8MB
MD5

6c399921f7e4c5d649ba6158e1910de9
SHA1

e143e65ad767cf4d9fac58edf6587ab95b8a6f5e
SHA256

811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8
SHA512

0a971bd1d5b15a0fbdcd38855cde3b7e01fe8dec61be56c130c850d20c571b8290a201d521931aea479d2945a0510716d220ab6365b5a0eec6a69d08c411bb92

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

Attributes

embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1260 created 2784 1260 WerFault.exe 811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3052 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 2784 WerFault.exe 811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe

description	pid	process	target process
PID 1260 created 2784	1260	WerFault.exe	811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe

pid	process
3052	rundll32.exe

pid	pid_target	process	target process
1260	2784	WerFault.exe	811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe
1260	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1260 WerFault.exe
Token: SeBackupPrivilege 1260 WerFault.exe
Token: SeDebugPrivilege 1260 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1260	WerFault.exe
Token: SeBackupPrivilege	1260	WerFault.exe
Token: SeDebugPrivilege	1260	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe

description	pid	process	target process
PID 2784 wrote to memory of 3052	2784	811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe	rundll32.exe
PID 2784 wrote to memory of 3052	2784	811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe	rundll32.exe
PID 2784 wrote to memory of 3052	2784	811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe
"C:\Users\Admin\AppData\Local\Temp\811301220548eee5868d59b62e9aca43c2a3fb281e3e9c782191fbf968c1caa8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\811301~1.DLL,s C:\Users\Admin\AppData\Local\Temp\811301~1.EXE
2⤵
- Loads dropped DLL
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 552
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\811301~1.DLL
MD5
4fefae628fbfd814e982ba2ca9dbb162

SHA1
ff40b0d051a1dc48c07af6d08533087f006e70b0

SHA256
ca475d2e01819b3c46e9357ddedab22a5c90ff3de9ef1e8db79b10217e8d21a7

SHA512
aee62440fe1beee154dec85ec337a2c042214633e4e58ade027c626b6bf36cb37378cab10649f72a634b7e648501076f53cf9327b922640686766e964e548dd2

Download Submit
\Users\Admin\AppData\Local\Temp\811301~1.DLL
MD5
4fefae628fbfd814e982ba2ca9dbb162

SHA1
ff40b0d051a1dc48c07af6d08533087f006e70b0

SHA256
ca475d2e01819b3c46e9357ddedab22a5c90ff3de9ef1e8db79b10217e8d21a7

SHA512
aee62440fe1beee154dec85ec337a2c042214633e4e58ade027c626b6bf36cb37378cab10649f72a634b7e648501076f53cf9327b922640686766e964e548dd2

Download Submit
memory/2784-114-0x000000000113F000-0x00000000012CE000-memory.dmp

Filesize
1.6MB

Download
memory/2784-115-0x00000000012E0000-0x0000000001485000-memory.dmp

Filesize
1.6MB

Download
memory/2784-116-0x0000000000400000-0x0000000000D9A000-memory.dmp

Filesize
9.6MB

Download
memory/3052-117-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing