danabot | 4d6d6199e2c3a26883a97fe9b5b0b947fa70254e4214bb9bea7065442ab9c0a1

General

Target

4d6d6199e2c3a26883a97fe9b5b0b947fa70254e4214bb9bea7065442ab9c0a1.exe
Size

1.8MB
MD5

8dbea1dbb96d435bdf102525efdfb988
SHA1

cadf23a6ab9663b063cf6348a245d3fb0ed1631c
SHA256

4d6d6199e2c3a26883a97fe9b5b0b947fa70254e4214bb9bea7065442ab9c0a1
SHA512

4a24a9089396c6b7e1c7b7ea98754a720b5b845f74172c3291f902ca7da9025c9625cd6ed82df0b435bcfb4ca52b385d5bd169990847da2f8dbdbe32844097f9

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

Attributes

embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\4D6D61~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\4D6D61~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\4D6D61~1.DLL	DanabotLoader2021
behavioral1/memory/592-122-0x0000000004330000-0x00000000045AC000-memory.dmp	DanabotLoader2021

Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

592 rundll32.exe
592 rundll32.exe

pid	process
592	rundll32.exe
592	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4d6d6199e2c3a26883a97fe9b5b0b947fa70254e4214bb9bea7065442ab9c0a1.exe

description	pid	process	target process
PID 3116 wrote to memory of 592	3116	4d6d6199e2c3a26883a97fe9b5b0b947fa70254e4214bb9bea7065442ab9c0a1.exe	rundll32.exe
PID 3116 wrote to memory of 592	3116	4d6d6199e2c3a26883a97fe9b5b0b947fa70254e4214bb9bea7065442ab9c0a1.exe	rundll32.exe
PID 3116 wrote to memory of 592	3116	4d6d6199e2c3a26883a97fe9b5b0b947fa70254e4214bb9bea7065442ab9c0a1.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\4d6d6199e2c3a26883a97fe9b5b0b947fa70254e4214bb9bea7065442ab9c0a1.exe
"C:\Users\Admin\AppData\Local\Temp\4d6d6199e2c3a26883a97fe9b5b0b947fa70254e4214bb9bea7065442ab9c0a1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4D6D61~1.DLL,s C:\Users\Admin\AppData\Local\Temp\4D6D61~1.EXE
2⤵
- Loads dropped DLL
PID:592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4D6D61~1.DLL
MD5
2572f69f8068de77aa0a5ae6b13dafb5

SHA1
94572ef31501a91434247f69804786f0781f67ca

SHA256
cfd47fafbfa24e5240bd11216383eb0c9927d5356c803e92c9858992764c3e35

SHA512
9b51152763448539cf5e939e114a792eb1253d5e4290352a52cc3cf186fdfa899412ee39c36b01711a72eb3149b8a118b1ecb027747c41cade4231ab9d33b1d1

Download Submit
\Users\Admin\AppData\Local\Temp\4D6D61~1.DLL
MD5
2572f69f8068de77aa0a5ae6b13dafb5

SHA1
94572ef31501a91434247f69804786f0781f67ca

SHA256
cfd47fafbfa24e5240bd11216383eb0c9927d5356c803e92c9858992764c3e35

SHA512
9b51152763448539cf5e939e114a792eb1253d5e4290352a52cc3cf186fdfa899412ee39c36b01711a72eb3149b8a118b1ecb027747c41cade4231ab9d33b1d1

Download Submit
\Users\Admin\AppData\Local\Temp\4D6D61~1.DLL
MD5
2572f69f8068de77aa0a5ae6b13dafb5

SHA1
94572ef31501a91434247f69804786f0781f67ca

SHA256
cfd47fafbfa24e5240bd11216383eb0c9927d5356c803e92c9858992764c3e35

SHA512
9b51152763448539cf5e939e114a792eb1253d5e4290352a52cc3cf186fdfa899412ee39c36b01711a72eb3149b8a118b1ecb027747c41cade4231ab9d33b1d1

Download Submit
memory/592-118-0x0000000000000000-mapping.dmp

Download
memory/592-122-0x0000000004330000-0x00000000045AC000-memory.dmp

Filesize
2.5MB

Download
memory/3116-116-0x0000000004D90000-0x0000000004F36000-memory.dmp

Filesize
1.6MB

Download
memory/3116-115-0x0000000004C00000-0x0000000004D8F000-memory.dmp

Filesize
1.6MB

Download
memory/3116-117-0x0000000000400000-0x0000000002CF9000-memory.dmp

Filesize
41.0MB

Download

Analysis

Sharing