danabot | c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795

General

Target

c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe
Size

1.8MB
MD5

86f2966e3a8e679b1a323e5dbcdc543a
SHA1

7658028ee7bc7e393ba599ee951b13e2c4ce1c08
SHA256

c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795
SHA512

a6d411fe695923ec34e4ec2c6fd7d61d50c9f59ef873af3117395295f05cf87a0455e58d0e1bbac4736a2c61ea3f42165f1a86fed1bf67c92b2756980b90ed98

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

Attributes

embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\C8F541~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\C8F541~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\C8F541~1.DLL	DanabotLoader2021
behavioral1/memory/1700-122-0x0000000004610000-0x000000000488C000-memory.dmp	DanabotLoader2021

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3792 created 3788 3792 WerFault.exe c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

1700 rundll32.exe
1700 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3792 3788 WerFault.exe c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe

description	pid	process	target process
PID 3792 created 3788	3792	WerFault.exe	c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe

pid	process
1700	rundll32.exe
1700	rundll32.exe

pid	pid_target	process	target process
3792	3788	WerFault.exe	c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3792 WerFault.exe
Token: SeBackupPrivilege 3792 WerFault.exe
Token: SeDebugPrivilege 3792 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3792	WerFault.exe
Token: SeBackupPrivilege	3792	WerFault.exe
Token: SeDebugPrivilege	3792	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe

description	pid	process	target process
PID 3788 wrote to memory of 1700	3788	c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe	rundll32.exe
PID 3788 wrote to memory of 1700	3788	c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe	rundll32.exe
PID 3788 wrote to memory of 1700	3788	c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe
"C:\Users\Admin\AppData\Local\Temp\c8f5419bb3e41ccd13060b58cd47cc0ed501271e8c8ea3bb0dd699aa28cf8795.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3788

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\C8F541~1.DLL,s C:\Users\Admin\AppData\Local\Temp\C8F541~1.EXE
2⤵
- Loads dropped DLL
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 580
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C8F541~1.DLL
MD5
e68b81cccd598d7540864d11f8a38910

SHA1
b71fed0180e206ab3f6103317a352dbc93f33801

SHA256
754b53603b62f4b3ee7499c9ee6f6f3a9eeab63256d1cc8b3c27d35882dcd0d5

SHA512
623694ca9608528b8d451a2bad59c9bdcc48b4c6979a49fd4f6213df5ba7bd9602ccfddefc14ef862cf617b28a61f8d8f58dfed2f0ce7c59c5dee7aa599ca00a

Download Submit
\Users\Admin\AppData\Local\Temp\C8F541~1.DLL
MD5
e68b81cccd598d7540864d11f8a38910

SHA1
b71fed0180e206ab3f6103317a352dbc93f33801

SHA256
754b53603b62f4b3ee7499c9ee6f6f3a9eeab63256d1cc8b3c27d35882dcd0d5

SHA512
623694ca9608528b8d451a2bad59c9bdcc48b4c6979a49fd4f6213df5ba7bd9602ccfddefc14ef862cf617b28a61f8d8f58dfed2f0ce7c59c5dee7aa599ca00a

Download Submit
\Users\Admin\AppData\Local\Temp\C8F541~1.DLL
MD5
e68b81cccd598d7540864d11f8a38910

SHA1
b71fed0180e206ab3f6103317a352dbc93f33801

SHA256
754b53603b62f4b3ee7499c9ee6f6f3a9eeab63256d1cc8b3c27d35882dcd0d5

SHA512
623694ca9608528b8d451a2bad59c9bdcc48b4c6979a49fd4f6213df5ba7bd9602ccfddefc14ef862cf617b28a61f8d8f58dfed2f0ce7c59c5dee7aa599ca00a

Download Submit
memory/1700-118-0x0000000000000000-mapping.dmp

Download
memory/1700-122-0x0000000004610000-0x000000000488C000-memory.dmp

Filesize
2.5MB

Download
memory/3788-115-0x0000000000A23000-0x0000000000BB2000-memory.dmp

Filesize
1.6MB

Download
memory/3788-117-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/3788-116-0x0000000000BC0000-0x0000000000D65000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads