danabot | 34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27

General

Target

34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe
Size

2.6MB
MD5

a329c16a70ac8358873a86b686537e6f
SHA1

586b589ce774d8778f303d2a2a0f0a3edcc020b2
SHA256

34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27
SHA512

faa867337e45caec169af27369b519e217601baa9fa251f3cf49818dc284d7f2c0c03b98689f78003273f7c0546a1c1c5e570ab1b435d4480166f41d5a295bc9

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

45.147.231.202

23.83.133.10

137.74.66.92

185.227.138.52

192.236.146.249

149.255.35.125

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\34E619~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\34E619~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\34E619~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\34E619~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\34E619~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\34E619~1.DLL	family_danabot

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

1 832 rundll32.exe
2 832 rundll32.exe
4 832 rundll32.exe
5 832 rundll32.exe
6 832 rundll32.exe
7 832 rundll32.exe
Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1404 regsvr32.exe
832 rundll32.exe
832 rundll32.exe
832 rundll32.exe
832 rundll32.exe

flow	pid	process
1	832	rundll32.exe
2	832	rundll32.exe
4	832	rundll32.exe
5	832	rundll32.exe
6	832	rundll32.exe
7	832	rundll32.exe

pid	process
1404	regsvr32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exeregsvr32.exe

description	pid	process	target process
PID 2024 wrote to memory of 1404	2024	34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe	regsvr32.exe
PID 2024 wrote to memory of 1404	2024	34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe	regsvr32.exe
PID 2024 wrote to memory of 1404	2024	34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe	regsvr32.exe
PID 2024 wrote to memory of 1404	2024	34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe	regsvr32.exe
PID 2024 wrote to memory of 1404	2024	34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe	regsvr32.exe
PID 2024 wrote to memory of 1404	2024	34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe	regsvr32.exe
PID 2024 wrote to memory of 1404	2024	34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe	regsvr32.exe
PID 1404 wrote to memory of 832	1404	regsvr32.exe	rundll32.exe
PID 1404 wrote to memory of 832	1404	regsvr32.exe	rundll32.exe
PID 1404 wrote to memory of 832	1404	regsvr32.exe	rundll32.exe
PID 1404 wrote to memory of 832	1404	regsvr32.exe	rundll32.exe
PID 1404 wrote to memory of 832	1404	regsvr32.exe	rundll32.exe
PID 1404 wrote to memory of 832	1404	regsvr32.exe	rundll32.exe
PID 1404 wrote to memory of 832	1404	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe
"C:\Users\Admin\AppData\Local\Temp\34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\34E619~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\34E619~1.EXE@2024
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\34E619~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\34E619~1.DLL
Filesize
2.4MB

MD5
13d2e6ddb55445d5d0866a9dcf8005ac

SHA1
16bc1fc71a7108cfe000ce19f10153a1f314760b

SHA256
da8a0dfaf5a35566fc013022fb512c836ce4d299d90b56ce553feb216b198338

SHA512
1ce66318ef4dd2677da8bde32a7f5b0dc90badca70eff12c0e03f08132fb8c41434207047cecd898c1dada75d6ba10285d1633a5d34757e572ee541dc9371dc8

Download Submit
\Users\Admin\AppData\Local\Temp\34E619~1.DLL
Filesize
2.4MB

MD5
13d2e6ddb55445d5d0866a9dcf8005ac

SHA1
16bc1fc71a7108cfe000ce19f10153a1f314760b

SHA256
da8a0dfaf5a35566fc013022fb512c836ce4d299d90b56ce553feb216b198338

SHA512
1ce66318ef4dd2677da8bde32a7f5b0dc90badca70eff12c0e03f08132fb8c41434207047cecd898c1dada75d6ba10285d1633a5d34757e572ee541dc9371dc8

Download Submit
\Users\Admin\AppData\Local\Temp\34E619~1.DLL
Filesize
2.4MB

MD5
13d2e6ddb55445d5d0866a9dcf8005ac

SHA1
16bc1fc71a7108cfe000ce19f10153a1f314760b

SHA256
da8a0dfaf5a35566fc013022fb512c836ce4d299d90b56ce553feb216b198338

SHA512
1ce66318ef4dd2677da8bde32a7f5b0dc90badca70eff12c0e03f08132fb8c41434207047cecd898c1dada75d6ba10285d1633a5d34757e572ee541dc9371dc8

Download Submit
\Users\Admin\AppData\Local\Temp\34E619~1.DLL
Filesize
2.4MB

MD5
13d2e6ddb55445d5d0866a9dcf8005ac

SHA1
16bc1fc71a7108cfe000ce19f10153a1f314760b

SHA256
da8a0dfaf5a35566fc013022fb512c836ce4d299d90b56ce553feb216b198338

SHA512
1ce66318ef4dd2677da8bde32a7f5b0dc90badca70eff12c0e03f08132fb8c41434207047cecd898c1dada75d6ba10285d1633a5d34757e572ee541dc9371dc8

Download Submit
\Users\Admin\AppData\Local\Temp\34E619~1.DLL
Filesize
2.4MB

MD5
13d2e6ddb55445d5d0866a9dcf8005ac

SHA1
16bc1fc71a7108cfe000ce19f10153a1f314760b

SHA256
da8a0dfaf5a35566fc013022fb512c836ce4d299d90b56ce553feb216b198338

SHA512
1ce66318ef4dd2677da8bde32a7f5b0dc90badca70eff12c0e03f08132fb8c41434207047cecd898c1dada75d6ba10285d1633a5d34757e572ee541dc9371dc8

Download Submit
\Users\Admin\AppData\Local\Temp\34E619~1.DLL
Filesize
2.4MB

MD5
13d2e6ddb55445d5d0866a9dcf8005ac

SHA1
16bc1fc71a7108cfe000ce19f10153a1f314760b

SHA256
da8a0dfaf5a35566fc013022fb512c836ce4d299d90b56ce553feb216b198338

SHA512
1ce66318ef4dd2677da8bde32a7f5b0dc90badca70eff12c0e03f08132fb8c41434207047cecd898c1dada75d6ba10285d1633a5d34757e572ee541dc9371dc8

Download Submit
memory/832-69-0x0000000002020000-0x000000000228B000-memory.dmp

Filesize
2.4MB

Download
memory/832-63-0x0000000000000000-mapping.dmp

Download
memory/1404-57-0x0000000000000000-mapping.dmp

Download
memory/1404-61-0x0000000001E70000-0x00000000020DB000-memory.dmp

Filesize
2.4MB

Download
memory/1404-58-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/2024-62-0x0000000000400000-0x00000000026EA000-memory.dmp

Filesize
34.9MB

Download
memory/2024-54-0x0000000004090000-0x0000000004307000-memory.dmp

Filesize
2.5MB

Download
memory/2024-55-0x0000000004090000-0x0000000004307000-memory.dmp

Filesize
2.5MB

Download
memory/2024-56-0x0000000004310000-0x000000000459B000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing