danabot | 5207afab0141c57edf034ce9b969e4c8d9722c97b8099b7b28054a541250c146

General

Target

222_737_810193.vbs
Size

1.3MB
MD5

9a6daf1dd79a5b780136e3c21acf6a8b
SHA1

8db287888a361391e501cf05f7958c09f75a90c4
SHA256

e730840f8a1ff98811c5a271bc482802db14c9a8f84641ac91b1ad4e0dba7a8f
SHA512

edf2e1b385541b9a26059f0ca5cb92c67533e75c96d653c67bdb48912aca7b0d65b83680ad94b1c380dc422a55274251c6384079a30dc34c5c7e51cb79a9ebae

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

1.5.78.29

71.61.197.13

128.43.39.106

68.164.114.181

243.7.235.34

185.92.222.238

192.71.249.51

42.180.72.123

159.159.89.172

135.231.151.187

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 3 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq	family_danabot
\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq	family_danabot
\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq	family_danabot

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

1 1112 rundll32.exe
3 1112 rundll32.exe
4 1112 rundll32.exe
5 1112 rundll32.exe
6 1112 rundll32.exe
7 1112 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1312 regsvr32.exe
1112 rundll32.exe

flow	pid	process
1	1112	rundll32.exe
3	1112	rundll32.exe
4	1112	rundll32.exe
5	1112	rundll32.exe
6	1112	rundll32.exe
7	1112	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

regsvr32.exerundll32.exe

pid	process
1312	regsvr32.exe
1312	regsvr32.exe
1312	regsvr32.exe
1312	regsvr32.exe
1312	regsvr32.exe
1312	regsvr32.exe
1312	regsvr32.exe
1312	regsvr32.exe
1112	rundll32.exe
1112	rundll32.exe
1112	rundll32.exe
1112	rundll32.exe
1112	rundll32.exe
1112	rundll32.exe
1112	rundll32.exe
1112	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WScript.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 908 wrote to memory of 956	908	WScript.exe	regsvr32.exe
PID 908 wrote to memory of 956	908	WScript.exe	regsvr32.exe
PID 908 wrote to memory of 956	908	WScript.exe	regsvr32.exe
PID 908 wrote to memory of 956	908	WScript.exe	regsvr32.exe
PID 908 wrote to memory of 956	908	WScript.exe	regsvr32.exe
PID 956 wrote to memory of 1312	956	regsvr32.exe	regsvr32.exe
PID 956 wrote to memory of 1312	956	regsvr32.exe	regsvr32.exe
PID 956 wrote to memory of 1312	956	regsvr32.exe	regsvr32.exe
PID 956 wrote to memory of 1312	956	regsvr32.exe	regsvr32.exe
PID 956 wrote to memory of 1312	956	regsvr32.exe	regsvr32.exe
PID 956 wrote to memory of 1312	956	regsvr32.exe	regsvr32.exe
PID 956 wrote to memory of 1312	956	regsvr32.exe	regsvr32.exe
PID 1312 wrote to memory of 1112	1312	regsvr32.exe	rundll32.exe
PID 1312 wrote to memory of 1112	1312	regsvr32.exe	rundll32.exe
PID 1312 wrote to memory of 1112	1312	regsvr32.exe	rundll32.exe
PID 1312 wrote to memory of 1112	1312	regsvr32.exe	rundll32.exe
PID 1312 wrote to memory of 1112	1312	regsvr32.exe	rundll32.exe
PID 1312 wrote to memory of 1112	1312	regsvr32.exe	rundll32.exe
PID 1312 wrote to memory of 1112	1312	regsvr32.exe	rundll32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\222_737_810193.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\System32\regsvr32.exe
regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq
2⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\regsvr32.exe
-s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq,f0
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq
Filesize
459KB

MD5
78ad1f6983266579b20b1605dbdc63b4

SHA1
e11f91abb0ad60cc5d781da51339cf196c499da7

SHA256
9a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa

SHA512
3509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097

Download Submit
\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq
Filesize
459KB

MD5
78ad1f6983266579b20b1605dbdc63b4

SHA1
e11f91abb0ad60cc5d781da51339cf196c499da7

SHA256
9a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa

SHA512
3509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097

Download Submit
\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq
Filesize
459KB

MD5
78ad1f6983266579b20b1605dbdc63b4

SHA1
e11f91abb0ad60cc5d781da51339cf196c499da7

SHA256
9a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa

SHA512
3509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097

Download Submit
memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download
memory/1112-61-0x0000000000000000-mapping.dmp

Download
memory/1112-64-0x0000000000310000-0x0000000000390000-memory.dmp

Filesize
512KB

Download
memory/1312-57-0x0000000000000000-mapping.dmp

Download
memory/1312-58-0x0000000075CD1000-0x0000000075CD3000-memory.dmp

Filesize
8KB

Download
memory/1312-60-0x0000000000180000-0x0000000000200000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads