f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c

General
Target

f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exe

Filesize

1MB

Completed

12-01-2022 07:15

Score
10/10
MD5

51913f93259de85f17d3590a8263589d

SHA1

c36fb4dade6e0c69e81b8e2f2a69090471c22f7a

SHA256

f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c

Malware Config

Extracted

Family danabot
Botnet 4
C2

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes
embedded_hash
422236FD601D11EE82825A484D26DD6F
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures 4

Filter: none

  • Danabot

    Description

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot Loader Component

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x000500000001ab2f-119.datDanabotLoader2021
    behavioral1/files/0x000500000001ab2f-120.datDanabotLoader2021
  • Loads dropped DLL
    rundll32.exe

    Reported IOCs

    pidprocess
    4228rundll32.exe
  • Suspicious use of WriteProcessMemory
    f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 344 wrote to memory of 4228344f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exerundll32.exe
    PID 344 wrote to memory of 4228344f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exerundll32.exe
    PID 344 wrote to memory of 4228344f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exerundll32.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exe
    "C:\Users\Admin\AppData\Local\Temp\f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exe"
    Suspicious use of WriteProcessMemory
    PID:344
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exe.dll,z C:\Users\Admin\AppData\Local\Temp\f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exe
      Loads dropped DLL
      PID:4228
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • C:\Users\Admin\AppData\Local\Temp\f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exe.dll

                            MD5

                            0afa9091328834665946d45b4f9b61b8

                            SHA1

                            c5175a0e0522bfe9889904ef1d765d04d272a64e

                            SHA256

                            08415b93a560bdf8a28bd646de06fd244127b34e9c91c14b54f62d33e68a70b7

                            SHA512

                            b861bb27bea714e3a06181b3765ab92bc76308c2f7761c05243b01feecad045a6036339b43ba0f62c3af45ed0429e810fbd8e27bb3d6333cfa7725f67cf3c6b2

                          • \Users\Admin\AppData\Local\Temp\f38ab9b98774509a4d1dbadc3f5c9a5f927979736ff89dd5892b380a9f09738c.exe.dll

                            MD5

                            0afa9091328834665946d45b4f9b61b8

                            SHA1

                            c5175a0e0522bfe9889904ef1d765d04d272a64e

                            SHA256

                            08415b93a560bdf8a28bd646de06fd244127b34e9c91c14b54f62d33e68a70b7

                            SHA512

                            b861bb27bea714e3a06181b3765ab92bc76308c2f7761c05243b01feecad045a6036339b43ba0f62c3af45ed0429e810fbd8e27bb3d6333cfa7725f67cf3c6b2

                          • memory/344-115-0x000000000092F000-0x0000000000A14000-memory.dmp

                          • memory/344-117-0x0000000000400000-0x000000000063F000-memory.dmp

                          • memory/344-116-0x0000000000A20000-0x0000000000B1C000-memory.dmp

                          • memory/4228-118-0x0000000000000000-mapping.dmp