danabot | 66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14

General

Target

66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe
Size

1.1MB
MD5

b38799f3027e9f9802b601606109f8b1
SHA1

262cba4af397835d1e908fc4e438434d5cd63862
SHA256

66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14
SHA512

f88e2134d8694f8aefd14d3d67b2233e776c0b802af451227ec186b82bf20aff60bf07107997cac46409364ae0a979f6c7ca87a31c8df52199b62d9e9e5509eb

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes

embedded_hash
422236FD601D11EE82825A484D26DD6F
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021
behavioral1/memory/1700-65-0x0000000001E40000-0x0000000001F91000-memory.dmp	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1700 rundll32.exe
1700 rundll32.exe
1700 rundll32.exe
1700 rundll32.exe

pid	process
1700	rundll32.exe
1700	rundll32.exe
1700	rundll32.exe
1700	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe

description	pid	process	target process
PID 1692 wrote to memory of 1700	1692	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 1692 wrote to memory of 1700	1692	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 1692 wrote to memory of 1700	1692	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 1692 wrote to memory of 1700	1692	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 1692 wrote to memory of 1700	1692	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 1692 wrote to memory of 1700	1692	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 1692 wrote to memory of 1700	1692	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe
"C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll,z C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe
2⤵
- Loads dropped DLL
PID:1700

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
17a86f90e52b739a38e9daf461e4898d

SHA1
a76aeb26aa0cd10debdb8a7e609242226315e362

SHA256
12d041ba81c20104d7b811ebc21028385f778ad193f9701b6b1a6dafefbf1fb5

SHA512
5bf1b57ca0bac9393b5d0baf02cbc50aeb7d5a4377cd44770bc62522594af2e564bd749403f25303f5d75ca23261eb620fd9a17becf67177fad7cc9cac3a12fd

Download Submit
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
17a86f90e52b739a38e9daf461e4898d

SHA1
a76aeb26aa0cd10debdb8a7e609242226315e362

SHA256
12d041ba81c20104d7b811ebc21028385f778ad193f9701b6b1a6dafefbf1fb5

SHA512
5bf1b57ca0bac9393b5d0baf02cbc50aeb7d5a4377cd44770bc62522594af2e564bd749403f25303f5d75ca23261eb620fd9a17becf67177fad7cc9cac3a12fd

Download Submit
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
17a86f90e52b739a38e9daf461e4898d

SHA1
a76aeb26aa0cd10debdb8a7e609242226315e362

SHA256
12d041ba81c20104d7b811ebc21028385f778ad193f9701b6b1a6dafefbf1fb5

SHA512
5bf1b57ca0bac9393b5d0baf02cbc50aeb7d5a4377cd44770bc62522594af2e564bd749403f25303f5d75ca23261eb620fd9a17becf67177fad7cc9cac3a12fd

Download Submit
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
17a86f90e52b739a38e9daf461e4898d

SHA1
a76aeb26aa0cd10debdb8a7e609242226315e362

SHA256
12d041ba81c20104d7b811ebc21028385f778ad193f9701b6b1a6dafefbf1fb5

SHA512
5bf1b57ca0bac9393b5d0baf02cbc50aeb7d5a4377cd44770bc62522594af2e564bd749403f25303f5d75ca23261eb620fd9a17becf67177fad7cc9cac3a12fd

Download Submit
\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
17a86f90e52b739a38e9daf461e4898d

SHA1
a76aeb26aa0cd10debdb8a7e609242226315e362

SHA256
12d041ba81c20104d7b811ebc21028385f778ad193f9701b6b1a6dafefbf1fb5

SHA512
5bf1b57ca0bac9393b5d0baf02cbc50aeb7d5a4377cd44770bc62522594af2e564bd749403f25303f5d75ca23261eb620fd9a17becf67177fad7cc9cac3a12fd

Download Submit
memory/1692-54-0x0000000000640000-0x0000000000725000-memory.dmp

Filesize
916KB

Download
memory/1692-55-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download
memory/1692-56-0x0000000000640000-0x0000000000725000-memory.dmp

Filesize
916KB

Download
memory/1692-57-0x00000000007F0000-0x00000000008EC000-memory.dmp

Filesize
1008KB

Download
memory/1692-58-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/1700-65-0x0000000001E40000-0x0000000001F91000-memory.dmp

Filesize
1.3MB

Download

Resubmissions

Analysis

Sharing