danabot | cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a

General

Target

cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe
Size

1.1MB
MD5

2e49f97a5a97ba0448bc259241398bef
SHA1

60327dc3e621f25117bc2562f2eb76cc110fca2b
SHA256

cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a
SHA512

440fe729652ef9f8f0e0af31f468dba28247d47e056feef7932498f93bf56046f0d1c9540b9602965ffe08fdb1944b0bb5da235ca3d9ca270b770c3f2b667c9c

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

192.119.110.4:443

Attributes

embedded_hash
8357B947FCA843DB2D85EC29EDCDEF3C
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

3920 rundll32.exe
3920 rundll32.exe

pid	process
3920	rundll32.exe
3920	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe

description	pid	process	target process
PID 1108 wrote to memory of 3920	1108	cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe	rundll32.exe
PID 1108 wrote to memory of 3920	1108	cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe	rundll32.exe
PID 1108 wrote to memory of 3920	1108	cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe
"C:\Users\Admin\AppData\Local\Temp\cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe.dll,z C:\Users\Admin\AppData\Local\Temp\cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe
2⤵
- Loads dropped DLL
PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe.dll
MD5
96cc061a6811f11a7ab28e6dc4256841

SHA1
9a1ba66e10b3ed107f14bd39635c223c7d18d4c9

SHA256
fcaa5cfe161ed68e449445744284b97db0addbfe661de967f7cc92917ce803a3

SHA512
67d303a0b261a5a6226ea865116b8d642db398386b424403ab81ceb77d4c0523d2253958e44f5d9f925438019135e6693a23c60fc86f891fd88ec74fe14082be

Download Submit
\Users\Admin\AppData\Local\Temp\cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe.dll
MD5
96cc061a6811f11a7ab28e6dc4256841

SHA1
9a1ba66e10b3ed107f14bd39635c223c7d18d4c9

SHA256
fcaa5cfe161ed68e449445744284b97db0addbfe661de967f7cc92917ce803a3

SHA512
67d303a0b261a5a6226ea865116b8d642db398386b424403ab81ceb77d4c0523d2253958e44f5d9f925438019135e6693a23c60fc86f891fd88ec74fe14082be

Download Submit
\Users\Admin\AppData\Local\Temp\cc4c11f8e7599cef56fe6ca5b62121dd9b361d7cd5efb90c0144314e6d98a41a.exe.dll
MD5
96cc061a6811f11a7ab28e6dc4256841

SHA1
9a1ba66e10b3ed107f14bd39635c223c7d18d4c9

SHA256
fcaa5cfe161ed68e449445744284b97db0addbfe661de967f7cc92917ce803a3

SHA512
67d303a0b261a5a6226ea865116b8d642db398386b424403ab81ceb77d4c0523d2253958e44f5d9f925438019135e6693a23c60fc86f891fd88ec74fe14082be

Download Submit
memory/1108-115-0x0000000000943000-0x0000000000A26000-memory.dmp

Filesize
908KB

Download
memory/1108-117-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/1108-116-0x0000000000A30000-0x0000000000B2A000-memory.dmp

Filesize
1000KB

Download
memory/3920-118-0x0000000000000000-mapping.dmp

Download
memory/3920-122-0x0000000004470000-0x00000000045BE000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing