danabot | 7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac

General

Target

7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe
Size

1.8MB
MD5

2359d1d4b8614b0178579dbfa91033f3
SHA1

ea737c837c81aaed8ad3b220e22cd632d83986db
SHA256

7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac
SHA512

ee7077606b365f1f840f5da5030c9251208f3790ad114451542cfbae89444609dbc4affe2d524b64a7223fbdca364cad49f14614799cc4fcb158be7a14ebd755

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

Attributes

embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7FF98A~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\7FF98A~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\7FF98A~1.DLL	DanabotLoader2021
behavioral1/memory/3204-122-0x0000000003F50000-0x00000000041CC000-memory.dmp	DanabotLoader2021

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2932 created 3764 2932 WerFault.exe 7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

3204 rundll32.exe
3204 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2932 3764 WerFault.exe 7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe

description	pid	process	target process
PID 2932 created 3764	2932	WerFault.exe	7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe

pid	process
3204	rundll32.exe
3204	rundll32.exe

pid	pid_target	process	target process
2932	3764	WerFault.exe	7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2932 WerFault.exe
Token: SeBackupPrivilege 2932 WerFault.exe
Token: SeDebugPrivilege 2932 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2932	WerFault.exe
Token: SeBackupPrivilege	2932	WerFault.exe
Token: SeDebugPrivilege	2932	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe

description	pid	process	target process
PID 3764 wrote to memory of 3204	3764	7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe	rundll32.exe
PID 3764 wrote to memory of 3204	3764	7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe	rundll32.exe
PID 3764 wrote to memory of 3204	3764	7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe
"C:\Users\Admin\AppData\Local\Temp\7ff98ad1098f15b36172887d410f1b732da3d03f9604e6c186869d191fa47dac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7FF98A~1.DLL,s C:\Users\Admin\AppData\Local\Temp\7FF98A~1.EXE
2⤵
- Loads dropped DLL
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 580
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7FF98A~1.DLL
MD5
12592fd6171fd2b8366b3579c951d2b9

SHA1
58385d28d9feac9fa604fd230509579cc237a07b

SHA256
7a58c77346e413607810d8c426e10245ff17c9a407daecf23b93de0d6479f592

SHA512
32d33bd6792e4395c1bf2014684ec80fb7486b69c5a3f087c6fb85bfef3d9eacf5de1ea298c50a155f4bd8e66a621ec36ca5e41b3849433c6fc36a449cfc5316

Download Submit
\Users\Admin\AppData\Local\Temp\7FF98A~1.DLL
MD5
12592fd6171fd2b8366b3579c951d2b9

SHA1
58385d28d9feac9fa604fd230509579cc237a07b

SHA256
7a58c77346e413607810d8c426e10245ff17c9a407daecf23b93de0d6479f592

SHA512
32d33bd6792e4395c1bf2014684ec80fb7486b69c5a3f087c6fb85bfef3d9eacf5de1ea298c50a155f4bd8e66a621ec36ca5e41b3849433c6fc36a449cfc5316

Download Submit
\Users\Admin\AppData\Local\Temp\7FF98A~1.DLL
MD5
12592fd6171fd2b8366b3579c951d2b9

SHA1
58385d28d9feac9fa604fd230509579cc237a07b

SHA256
7a58c77346e413607810d8c426e10245ff17c9a407daecf23b93de0d6479f592

SHA512
32d33bd6792e4395c1bf2014684ec80fb7486b69c5a3f087c6fb85bfef3d9eacf5de1ea298c50a155f4bd8e66a621ec36ca5e41b3849433c6fc36a449cfc5316

Download Submit
memory/3204-118-0x0000000000000000-mapping.dmp

Download
memory/3204-122-0x0000000003F50000-0x00000000041CC000-memory.dmp

Filesize
2.5MB

Download
memory/3764-115-0x0000000000D9A000-0x0000000000F29000-memory.dmp

Filesize
1.6MB

Download
memory/3764-117-0x0000000000400000-0x0000000000902000-memory.dmp

Filesize
5.0MB

Download
memory/3764-116-0x0000000000F30000-0x00000000010D5000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads