danabot | 1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2

Resubmissions

17-01-2022 22:06

220117-11dcqsdad3 10

13-01-2022 16:33

220113-t2j4cabegk 10

Analysis

max time kernel
140s
max time network
124s
platform
windows10_x64
resource
win10-en-20211208
submitted
13-01-2022 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe
Size

1.1MB
MD5

67c56114c8ad71ae8d5490f2aed56107
SHA1

631459c6a43f3c303d011436d4ad4a620b3ca336
SHA256

1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2
SHA512

5e652b84508006b8f0cab7b6252a0918dae3fabe48c8ff084d2a4f97ed926532fd60f5c1d9ee0f00d51e8ac25c647948b63aa4689428ab7bd3d19ed13bc65ab9

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

103.175.16.113:443

103.175.16.114:443

Attributes

embedded_hash
422236FD601D11EE82825A484D26DD6F
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe.dll	DanabotLoader2021
behavioral1/memory/3668-122-0x0000000004190000-0x00000000042E1000-memory.dmp	DanabotLoader2021

Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

3668 rundll32.exe
3668 rundll32.exe

pid	process
3668	rundll32.exe
3668	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe

description	pid	process	target process
PID 2744 wrote to memory of 3668	2744	1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe	rundll32.exe
PID 2744 wrote to memory of 3668	2744	1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe	rundll32.exe
PID 2744 wrote to memory of 3668	2744	1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe
"C:\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe.dll,z C:\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe
2⤵
- Loads dropped DLL
PID:3668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe.dll
MD5
d4403b3bc842ce8889634af2dc564362

SHA1
e1206e4321e3598fdca1f91e52a83fe379ee1993

SHA256
cf88aac54a212f7024999828d68a604821ac9fa8ab37d77a1f5a2dec7892eb6f

SHA512
0d4dbcb2ab7b9f148528a96b14c21ffd2f5ac03b15788aabbc2beadcc794dbae87f03063ca09539c64f5b2a33982c6e3ab97c39caf9745f3b91ab9c063467319

Download Submit
\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe.dll
MD5
d4403b3bc842ce8889634af2dc564362

SHA1
e1206e4321e3598fdca1f91e52a83fe379ee1993

SHA256
cf88aac54a212f7024999828d68a604821ac9fa8ab37d77a1f5a2dec7892eb6f

SHA512
0d4dbcb2ab7b9f148528a96b14c21ffd2f5ac03b15788aabbc2beadcc794dbae87f03063ca09539c64f5b2a33982c6e3ab97c39caf9745f3b91ab9c063467319

Download Submit
\Users\Admin\AppData\Local\Temp\1a5b51c6da5399571b495e251c10eae4b9875efb0cdc8e76abd699a887abb1b2.exe.dll
MD5
d4403b3bc842ce8889634af2dc564362

SHA1
e1206e4321e3598fdca1f91e52a83fe379ee1993

SHA256
cf88aac54a212f7024999828d68a604821ac9fa8ab37d77a1f5a2dec7892eb6f

SHA512
0d4dbcb2ab7b9f148528a96b14c21ffd2f5ac03b15788aabbc2beadcc794dbae87f03063ca09539c64f5b2a33982c6e3ab97c39caf9745f3b91ab9c063467319

Download Submit
memory/2744-116-0x0000000000A50000-0x0000000000B4D000-memory.dmp

Filesize
1012KB

Download
memory/2744-115-0x0000000000960000-0x0000000000A45000-memory.dmp

Filesize
916KB

Download
memory/2744-117-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/3668-118-0x0000000000000000-mapping.dmp

Download
memory/3668-122-0x0000000004190000-0x00000000042E1000-memory.dmp

Filesize
1.3MB

Download