danabot | 1027b3f9e451a16896a4b06e851002ab01ca153421b17cbad6b0e73fac85ed4a

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-en-20211208
submitted
09/01/2022, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0347b84f4e3d0aa6a1009f509539e2b1.exe
Size 1.1MB
Sample220109-k8f6laddf2
SHA256 1027b3f9e451a16896a4b06e851002ab01ca153421b17cbad6b0e73fac85ed4a
MD5 0347b84f4e3d0aa6a1009f509539e2b1
SHA1 48186b9449ca1bbce11c8cc03d5b2c790fb8db40
SHA512 a9a070821792f07feacdfe3a1d43bd7d2ecd1416a068ad10a3990f78cc9b2c57f58e5db9fb7be483d9cd9f23fd815a9162adbdaa0635264525c5aa55cf4ede55
MD5 SHA1 SHA512

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

192.119.110.4:443
192.236.194.72:443

Attributes

embedded_hash
422236FD601D11EE82825A484D26DD6F
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 6 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012230-61.dat	DanabotLoader2021
behavioral1/files/0x0008000000012230-62.dat	DanabotLoader2021
behavioral1/files/0x0008000000012230-64.dat	DanabotLoader2021
behavioral1/files/0x0008000000012230-63.dat	DanabotLoader2021
behavioral1/files/0x0008000000012230-65.dat	DanabotLoader2021
behavioral1/memory/1356-66-0x0000000000860000-0x00000000009AD000-memory.dmp	DanabotLoader2021

Loads dropped DLL 4 IoCs

pid	Process
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1356	740	0347b84f4e3d0aa6a1009f509539e2b1.exe	29
PID 740 wrote to memory of 1356	740	0347b84f4e3d0aa6a1009f509539e2b1.exe	29
PID 740 wrote to memory of 1356	740	0347b84f4e3d0aa6a1009f509539e2b1.exe	29
PID 740 wrote to memory of 1356	740	0347b84f4e3d0aa6a1009f509539e2b1.exe	29
PID 740 wrote to memory of 1356	740	0347b84f4e3d0aa6a1009f509539e2b1.exe	29
PID 740 wrote to memory of 1356	740	0347b84f4e3d0aa6a1009f509539e2b1.exe	29
PID 740 wrote to memory of 1356	740	0347b84f4e3d0aa6a1009f509539e2b1.exe	29

C:\Users\Admin\AppData\Local\Temp\0347b84f4e3d0aa6a1009f509539e2b1.exe
"C:\Users\Admin\AppData\Local\Temp\0347b84f4e3d0aa6a1009f509539e2b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\0347b84f4e3d0aa6a1009f509539e2b1.exe.dll,z C:\Users\Admin\AppData\Local\Temp\0347b84f4e3d0aa6a1009f509539e2b1.exe
  2⤵
  - Loads dropped DLL
  PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-55-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/740-56-0x0000000004590000-0x0000000004672000-memory.dmp

Download

memory/740-57-0x0000000004680000-0x000000000477A000-memory.dmp

Download

memory/740-58-0x0000000000400000-0x0000000002C53000-memory.dmp

Download

memory/1356-66-0x0000000000860000-0x00000000009AD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads