danabot | 692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618

General

Target

692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe
Size

1.1MB
MD5

44c530a0e71accd063d4fdd9fed58c4a
SHA1

34951074dff2d0c3965a0436f5f275161e4d934b
SHA256

692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618
SHA512

786a79b06082943f6cb929fe03a2bccf2a36b1d10e2f1b1c4ccd0a0036871a2f44c3e2e2761fd5ef1bf4159392e4a42afdcce0514644be5d289c84e2ae5f8534

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes

embedded_hash
422236FD601D11EE82825A484D26DD6F
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe.dll	DanabotLoader2021
behavioral1/memory/3260-122-0x0000000003E70000-0x0000000003FC1000-memory.dmp	DanabotLoader2021

Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

3260 rundll32.exe
3260 rundll32.exe

pid	process
3260	rundll32.exe
3260	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe

description	pid	process	target process
PID 2708 wrote to memory of 3260	2708	692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe	rundll32.exe
PID 2708 wrote to memory of 3260	2708	692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe	rundll32.exe
PID 2708 wrote to memory of 3260	2708	692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe
"C:\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe.dll,z C:\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe
2⤵
- Loads dropped DLL
PID:3260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe.dll
MD5
f586657c13563665a34b4cec43238f7e

SHA1
65d1dac8e77701532251e3d2e17301edf86d7a49

SHA256
041e446847e67c5cf10c095871bdb037652067fc613c5cddc45f7c5ffd41bafb

SHA512
4ed1029cf28d68f5c17fa2692e5d9b935de1e4a97d960343df581f3bc5bd82eb4fe7fd6f260356933521ba53ba60d04147ef64a0eafc435e5af498414b3929bd

Download Submit
\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe.dll
MD5
f586657c13563665a34b4cec43238f7e

SHA1
65d1dac8e77701532251e3d2e17301edf86d7a49

SHA256
041e446847e67c5cf10c095871bdb037652067fc613c5cddc45f7c5ffd41bafb

SHA512
4ed1029cf28d68f5c17fa2692e5d9b935de1e4a97d960343df581f3bc5bd82eb4fe7fd6f260356933521ba53ba60d04147ef64a0eafc435e5af498414b3929bd

Download Submit
\Users\Admin\AppData\Local\Temp\692de5e934f95751a0a059a36e5886df4cb43ac4bdef3538e59fc67fedc6d618.exe.dll
MD5
f586657c13563665a34b4cec43238f7e

SHA1
65d1dac8e77701532251e3d2e17301edf86d7a49

SHA256
041e446847e67c5cf10c095871bdb037652067fc613c5cddc45f7c5ffd41bafb

SHA512
4ed1029cf28d68f5c17fa2692e5d9b935de1e4a97d960343df581f3bc5bd82eb4fe7fd6f260356933521ba53ba60d04147ef64a0eafc435e5af498414b3929bd

Download Submit
memory/2708-115-0x00000000008EE000-0x00000000009D3000-memory.dmp

Filesize
916KB

Download
memory/2708-116-0x00000000009E0000-0x0000000000ADC000-memory.dmp

Filesize
1008KB

Download
memory/2708-117-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/3260-118-0x0000000000000000-mapping.dmp

Download
memory/3260-122-0x0000000003E70000-0x0000000003FC1000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing