danabot | 9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6

General

Target

9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe
Size

1.1MB
MD5

7d73bbc0c762f65500d81187cabb075d
SHA1

e8a1f531e3ad3a1ee0fecccf34d0f23b6f452a53
SHA256

9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6
SHA512

83455a8f8dbcfb90bcd7a4538dbc89d799710489e21d17cda7a2cdebbcc6679ae2e027835aa4c20de63c75451af37c3ebb614d6217dc81fe10db0055dfb9ec57

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

192.119.110.4:443

Attributes

embedded_hash
8357B947FCA843DB2D85EC29EDCDEF3C
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

3960 rundll32.exe
3960 rundll32.exe

pid	process
3960	rundll32.exe
3960	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe

description	pid	process	target process
PID 2608 wrote to memory of 3960	2608	9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe	rundll32.exe
PID 2608 wrote to memory of 3960	2608	9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe	rundll32.exe
PID 2608 wrote to memory of 3960	2608	9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe
"C:\Users\Admin\AppData\Local\Temp\9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe.dll,z C:\Users\Admin\AppData\Local\Temp\9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe
2⤵
- Loads dropped DLL
PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe.dll
MD5
73299badfad4abdec94d46a03a62583b

SHA1
c710996b88a6a94220d52d5d1b6cff1b096808f1

SHA256
7c6a1462e625e68b514aa9a6ec339711fe5b4f7f1ad30dcb03ea4ec16ea10f10

SHA512
c50df175f10efd7a081cbc2cef47653b310863e24a532472c612c6d154af5b9d29f2485ac248bcf3f0862d614561f3c6e3b4a7e312c571d4de9ae6d705504cb2

Download Submit
\Users\Admin\AppData\Local\Temp\9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe.dll
MD5
73299badfad4abdec94d46a03a62583b

SHA1
c710996b88a6a94220d52d5d1b6cff1b096808f1

SHA256
7c6a1462e625e68b514aa9a6ec339711fe5b4f7f1ad30dcb03ea4ec16ea10f10

SHA512
c50df175f10efd7a081cbc2cef47653b310863e24a532472c612c6d154af5b9d29f2485ac248bcf3f0862d614561f3c6e3b4a7e312c571d4de9ae6d705504cb2

Download Submit
\Users\Admin\AppData\Local\Temp\9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6.exe.dll
MD5
73299badfad4abdec94d46a03a62583b

SHA1
c710996b88a6a94220d52d5d1b6cff1b096808f1

SHA256
7c6a1462e625e68b514aa9a6ec339711fe5b4f7f1ad30dcb03ea4ec16ea10f10

SHA512
c50df175f10efd7a081cbc2cef47653b310863e24a532472c612c6d154af5b9d29f2485ac248bcf3f0862d614561f3c6e3b4a7e312c571d4de9ae6d705504cb2

Download Submit
memory/2608-115-0x00000000007E9000-0x00000000008CC000-memory.dmp

Filesize
908KB

Download
memory/2608-117-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/2608-116-0x00000000008D0000-0x00000000009CA000-memory.dmp

Filesize
1000KB

Download
memory/3960-118-0x0000000000000000-mapping.dmp

Download
memory/3960-122-0x00000000008A0000-0x00000000009EE000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing