danabot | 66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14

Target

66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe
Size

1.1MB
MD5

b38799f3027e9f9802b601606109f8b1
SHA1

262cba4af397835d1e908fc4e438434d5cd63862
SHA256

66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14
SHA512

f88e2134d8694f8aefd14d3d67b2233e776c0b802af451227ec186b82bf20aff60bf07107997cac46409364ae0a979f6c7ca87a31c8df52199b62d9e9e5509eb

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes

embedded_hash
422236FD601D11EE82825A484D26DD6F
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021
behavioral1/memory/2688-122-0x0000000000D00000-0x0000000000E51000-memory.dmp	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021

Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

2688 rundll32.exe
2688 rundll32.exe

pid	process
2688	rundll32.exe
2688	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe

description	pid	process	target process
PID 2328 wrote to memory of 2688	2328	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 2328 wrote to memory of 2688	2328	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 2328 wrote to memory of 2688	2328	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe
"C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll,z C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe
2⤵
- Loads dropped DLL
PID:2688

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
983ac63a7a4f4edbdde5d737a7043a1b

SHA1
c21b7e32622462175571c666928289d9c055a571

SHA256
04e9d00ec06ade6745463571cab916853a0d58c21deddfbae6df1131338d9de9

SHA512
7bf869fbc9ef1b7b9ba5f6b1ce460d14158c626950951f4ec7296a10514be823c179245972c4c821854bcbcb94f3b206a25842f460b64ae1f027ccde59437129

Download Submit
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
983ac63a7a4f4edbdde5d737a7043a1b

SHA1
c21b7e32622462175571c666928289d9c055a571

SHA256
04e9d00ec06ade6745463571cab916853a0d58c21deddfbae6df1131338d9de9

SHA512
7bf869fbc9ef1b7b9ba5f6b1ce460d14158c626950951f4ec7296a10514be823c179245972c4c821854bcbcb94f3b206a25842f460b64ae1f027ccde59437129

Download Submit
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
983ac63a7a4f4edbdde5d737a7043a1b

SHA1
c21b7e32622462175571c666928289d9c055a571

SHA256
04e9d00ec06ade6745463571cab916853a0d58c21deddfbae6df1131338d9de9

SHA512
7bf869fbc9ef1b7b9ba5f6b1ce460d14158c626950951f4ec7296a10514be823c179245972c4c821854bcbcb94f3b206a25842f460b64ae1f027ccde59437129

Download Submit
memory/2328-115-0x00000000007BA000-0x000000000089F000-memory.dmp

Filesize
916KB

Download
memory/2328-116-0x0000000000A60000-0x0000000000B5C000-memory.dmp

Filesize
1008KB

Download
memory/2328-117-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/2688-118-0x0000000000000000-mapping.dmp

Download
memory/2688-122-0x0000000000D00000-0x0000000000E51000-memory.dmp

Filesize
1.3MB

Download

Resubmissions

Analysis

Sharing

General