danabot | 22e24d2ec014638a674b94625117b0feded22f60d4b255df7c216705168a9dc2

General

Target

22e24d2ec014638a674b94625117b0feded22f60d4b255df7c216705168a9dc2.dll
Size

1.4MB
MD5

efdd7e7c76112ffdeb98643b8be683ce
SHA1

2d57ff5fd14bd8afbe44fed327fb240a2c38d22b
SHA256

22e24d2ec014638a674b94625117b0feded22f60d4b255df7c216705168a9dc2
SHA512

cb539258996c99ea83c7333ecbcc4a1087e2e98f1b406c0d15e0e92a0a145a2e9e2a4f4e1f7638ac12d5ca3b8fec050e324140fd2a33f3ae1addcab31e44f57e

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

C2

91.137.81.126

195.123.246.209

151.236.14.84

194.27.0.35

73.8.230.123

178.220.152.36

232.144.184.182

119.59.233.97

214.7.139.122

95.126.163.104

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

2 1632 rundll32.exe
3 1632 rundll32.exe
4 1632 rundll32.exe
5 1632 rundll32.exe
6 1632 rundll32.exe
7 1632 rundll32.exe
8 1632 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

812 1748 WerFault.exe rundll32.exe

flow	pid	process
2	1632	rundll32.exe
3	1632	rundll32.exe
4	1632	rundll32.exe
5	1632	rundll32.exe
6	1632	rundll32.exe
7	1632	rundll32.exe
8	1632	rundll32.exe

pid	pid_target	process	target process
812	1748	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1632	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1632	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1632	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1632	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1632	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1632	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1632	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 812	1748	rundll32.exe	WerFault.exe
PID 1748 wrote to memory of 812	1748	rundll32.exe	WerFault.exe
PID 1748 wrote to memory of 812	1748	rundll32.exe	WerFault.exe
PID 1748 wrote to memory of 812	1748	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22e24d2ec014638a674b94625117b0feded22f60d4b255df7c216705168a9dc2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22e24d2ec014638a674b94625117b0feded22f60d4b255df7c216705168a9dc2.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\22e24d2ec014638a674b94625117b0feded22f60d4b255df7c216705168a9dc2.dll,f0
3⤵
- Blocklisted process makes network request
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 380
3⤵
- Program crash
PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-60-0x0000000000000000-mapping.dmp

Download
memory/1632-57-0x0000000000000000-mapping.dmp

Download
memory/1632-59-0x0000000000A30000-0x0000000000B9D000-memory.dmp

Filesize
1.4MB

Download
memory/1748-54-0x0000000000000000-mapping.dmp

Download
memory/1748-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1748-56-0x0000000000930000-0x0000000000A9D000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing