danabot | 32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4

General

Target

32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe
Size

1.1MB
MD5

722ab33bdfacbf936ffa60366d33e686
SHA1

0a3f8db0d8b4486c04616828c94e1916959380a7
SHA256

32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4
SHA512

73f5698f7757ff7520c2fddf03e31f8d7a9c75012da3f9ade68ed0b76db768415a1b377a2a4ac6f0b410948905442686a4fe2375d766892fdf59b15ed28fb9d7

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes

embedded_hash
422236FD601D11EE82825A484D26DD6F
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe.dll	DanabotLoader2021
behavioral1/memory/3228-122-0x00000000043A0000-0x00000000044F1000-memory.dmp	DanabotLoader2021

Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

3228 rundll32.exe
3228 rundll32.exe

pid	process
3228	rundll32.exe
3228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe

description	pid	process	target process
PID 2708 wrote to memory of 3228	2708	32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe	rundll32.exe
PID 2708 wrote to memory of 3228	2708	32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe	rundll32.exe
PID 2708 wrote to memory of 3228	2708	32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe
"C:\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe.dll,z C:\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe
2⤵
- Loads dropped DLL
PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe.dll
MD5
95fec6544290c62dbb884eb6b8922bc1

SHA1
80f6ebd9eedff5cdca9958767e4dc6dfc593f414

SHA256
210727687b843b654ba76d5984fbf89fa9483a65c41e77393653a4492eb9757f

SHA512
b7303df5ffde8ef3b956448fa4a82a30f6f647ca8abb0dd820177ec31f950f67f959da52a2b5c8eed63c88726a227762a06dcb0dc6962036ff3007007bc6c3ad

Download Submit
\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe.dll
MD5
95fec6544290c62dbb884eb6b8922bc1

SHA1
80f6ebd9eedff5cdca9958767e4dc6dfc593f414

SHA256
210727687b843b654ba76d5984fbf89fa9483a65c41e77393653a4492eb9757f

SHA512
b7303df5ffde8ef3b956448fa4a82a30f6f647ca8abb0dd820177ec31f950f67f959da52a2b5c8eed63c88726a227762a06dcb0dc6962036ff3007007bc6c3ad

Download Submit
\Users\Admin\AppData\Local\Temp\32c6cedefebc69003932d53b9527047d3a1bbd5ab2bd9c5641d3cc7bb9df10d4.exe.dll
MD5
95fec6544290c62dbb884eb6b8922bc1

SHA1
80f6ebd9eedff5cdca9958767e4dc6dfc593f414

SHA256
210727687b843b654ba76d5984fbf89fa9483a65c41e77393653a4492eb9757f

SHA512
b7303df5ffde8ef3b956448fa4a82a30f6f647ca8abb0dd820177ec31f950f67f959da52a2b5c8eed63c88726a227762a06dcb0dc6962036ff3007007bc6c3ad

Download Submit
memory/2708-115-0x0000000000955000-0x0000000000A3A000-memory.dmp

Filesize
916KB

Download
memory/2708-116-0x0000000000A40000-0x0000000000B3C000-memory.dmp

Filesize
1008KB

Download
memory/2708-117-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/3228-118-0x0000000000000000-mapping.dmp

Download
memory/3228-122-0x00000000043A0000-0x00000000044F1000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing