danabot | cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c

Analysis

max time kernel
140s
max time network
138s
platform
windows10_x64
resource
win10-en-20211208
submitted
12-01-2022 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe
Size

1.1MB
MD5

d2d40f9caf63648d694ef8df6651179b
SHA1

5322ac4744a7d0eb9556464ab7b3aefe31ebf42d
SHA256

cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c
SHA512

70e3b235b5712582aa5ae55a93e14e6e6e5bc7484c78df948b17b153067f3381f1b6649bf20f0307221ad22388b5a58b532c9e567f7b585cf1f49a0989ce84ad

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes

embedded_hash
422236FD601D11EE82825A484D26DD6F
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3880 rundll32.exe

pid	process
3880	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe

description	pid	process	target process
PID 2640 wrote to memory of 3880	2640	cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe	rundll32.exe
PID 2640 wrote to memory of 3880	2640	cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe	rundll32.exe
PID 2640 wrote to memory of 3880	2640	cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe
"C:\Users\Admin\AppData\Local\Temp\cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe.dll,z C:\Users\Admin\AppData\Local\Temp\cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe
2⤵
- Loads dropped DLL
PID:3880

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe.dll
MD5
ee67279f005df502943f1ee3da5ae240

SHA1
1fa8048c1734c7227d48d0157b2ddd1e238693f9

SHA256
b210a2f616e90b5300beb655bf9abc8210ee61f8d645edbf2684dd9d307a290d

SHA512
15676f13f80eb922fbd188a8814be87405e7a575309519222c8fe2e908287eed4738727abaae7206f029b81372c6ff36d107968bcf529b96c9f672559f1070a7

Download Submit
\Users\Admin\AppData\Local\Temp\cbc643a23344a15172c9de86cb387d87e62fe317f3e850c5a43577f8c9b35a1c.exe.dll
MD5
ee67279f005df502943f1ee3da5ae240

SHA1
1fa8048c1734c7227d48d0157b2ddd1e238693f9

SHA256
b210a2f616e90b5300beb655bf9abc8210ee61f8d645edbf2684dd9d307a290d

SHA512
15676f13f80eb922fbd188a8814be87405e7a575309519222c8fe2e908287eed4738727abaae7206f029b81372c6ff36d107968bcf529b96c9f672559f1070a7

Download Submit
memory/2640-118-0x0000000000892000-0x0000000000977000-memory.dmp

Filesize
916KB

Download
memory/2640-119-0x00000000009C0000-0x0000000000ABC000-memory.dmp

Filesize
1008KB

Download
memory/2640-120-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/3880-121-0x0000000000000000-mapping.dmp

Download