danabot | 244b5656b4f18ed296ce284cce8dfb7f3c580a46ead28f946a69adcd4c7e997c

General

Target

7827_99_83872.vbs
Size

1.4MB
MD5

c9510672ebc4fc0795a731a02d89fcc6
SHA1

1c7d106778171f2e0b54a0db69cbe5364e8f6fd5
SHA256

cb0a6515ebf78cceb86464ac829ea872eea726aa7b8e34b8b43e1f7f36791711
SHA512

8dee2bdad143a339074faf05a824983d722bd6b30cc9f9a4b8632ec277d87ee5edee77ec6d5713946681795165c105b570b6621313884e6eb7b1ac7d46dc7c33

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

1.5.78.29

71.61.197.13

128.43.39.106

68.164.114.181

243.7.235.34

185.92.222.238

192.71.249.51

42.180.72.123

159.159.89.172

135.231.151.187

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq	family_danabot
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq	family_danabot
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq	family_danabot
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq	family_danabot

Blocklisted process makes network request 9 IoCs

Processes:

rundll32.exe

flow	pid	process
24	1688	rundll32.exe
25	1688	rundll32.exe
32	1688	rundll32.exe
46	1688	rundll32.exe
50	1688	rundll32.exe
51	1688	rundll32.exe
53	1688	rundll32.exe
56	1688	rundll32.exe
63	1688	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

204 regsvr32.exe
204 regsvr32.exe
1688 rundll32.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

regsvr32.exerundll32.exe

pid	process
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
204	regsvr32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe
1688	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

WScript.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4664 wrote to memory of 448	4664	WScript.exe	regsvr32.exe
PID 4664 wrote to memory of 448	4664	WScript.exe	regsvr32.exe
PID 448 wrote to memory of 204	448	regsvr32.exe	regsvr32.exe
PID 448 wrote to memory of 204	448	regsvr32.exe	regsvr32.exe
PID 448 wrote to memory of 204	448	regsvr32.exe	regsvr32.exe
PID 204 wrote to memory of 1688	204	regsvr32.exe	rundll32.exe
PID 204 wrote to memory of 1688	204	regsvr32.exe	rundll32.exe
PID 204 wrote to memory of 1688	204	regsvr32.exe	rundll32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7827_99_83872.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\System32\regsvr32.exe
regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq
2⤵
- Suspicious use of WriteProcessMemory
PID:448

C:\Windows\SysWOW64\regsvr32.exe
-s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq,f0
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq
Filesize
459KB

MD5
78ad1f6983266579b20b1605dbdc63b4

SHA1
e11f91abb0ad60cc5d781da51339cf196c499da7

SHA256
9a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa

SHA512
3509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097

Download Submit
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq
Filesize
459KB

MD5
78ad1f6983266579b20b1605dbdc63b4

SHA1
e11f91abb0ad60cc5d781da51339cf196c499da7

SHA256
9a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa

SHA512
3509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097

Download Submit
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq
Filesize
459KB

MD5
78ad1f6983266579b20b1605dbdc63b4

SHA1
e11f91abb0ad60cc5d781da51339cf196c499da7

SHA256
9a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa

SHA512
3509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097

Download Submit
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq
Filesize
459KB

MD5
78ad1f6983266579b20b1605dbdc63b4

SHA1
e11f91abb0ad60cc5d781da51339cf196c499da7

SHA256
9a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa

SHA512
3509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097

Download Submit
memory/204-132-0x0000000000000000-mapping.dmp

Download
memory/204-135-0x0000000000C80000-0x0000000000D00000-memory.dmp

Filesize
512KB

Download
memory/448-130-0x0000000000000000-mapping.dmp

Download
memory/1688-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads