danabot | 54eb9469e2bc4989a1a12c2892b4c1a6f845ce490f9aa5d0edf1389410db717f

General

Target

Receipt#2019#6dee13ba19fcef2b7b9c5f05086580cb1.vbs
Size

4.9MB
MD5

f3ed87b32b193290549208db85679ca6
SHA1

ba83a0ec36bcf851b9a12bcaf545973f7499193c
SHA256

4747f8d0515a3209e45ffdb4fe25cf62f8b5db48faff4357362c45d56e25db83
SHA512

bcdcd1fa7b075d99ccb982ea81fef77fc6b51f10fd3e8f6be88f7abeb74f4f410d9752077233a71929520c4b9cd54c6ec770fb0e41ee178fd865252f446169e9

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

214.117.153.178

254.72.43.217

150.116.120.176

199.21.37.100

46.168.211.8

175.16.177.89

17.31.87.118

95.179.168.37

117.111.1.23

207.148.83.108

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

yara_rule
family_danabot
C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt	family_danabot
\Users\Admin\AppData\Local\Temp\IEeHCa.txt	family_danabot
\Users\Admin\AppData\Local\Temp\IEeHCa.txt	family_danabot

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

2 1980 rundll32.exe
3 1980 rundll32.exe
4 1980 rundll32.exe
7 1980 rundll32.exe
8 1980 rundll32.exe
9 1980 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1736 regsvr32.exe
1980 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
2	1980	rundll32.exe
3	1980	rundll32.exe
4	1980	rundll32.exe
7	1980	rundll32.exe
8	1980	rundll32.exe
9	1980	rundll32.exe

pid	process
1736	regsvr32.exe
1980	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WScript.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 904 wrote to memory of 1280	904	WScript.exe	regsvr32.exe
PID 904 wrote to memory of 1280	904	WScript.exe	regsvr32.exe
PID 904 wrote to memory of 1280	904	WScript.exe	regsvr32.exe
PID 904 wrote to memory of 1280	904	WScript.exe	regsvr32.exe
PID 904 wrote to memory of 1280	904	WScript.exe	regsvr32.exe
PID 1280 wrote to memory of 1736	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1736	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1736	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1736	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1736	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1736	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1736	1280	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 1980	1736	regsvr32.exe	rundll32.exe
PID 1736 wrote to memory of 1980	1736	regsvr32.exe	rundll32.exe
PID 1736 wrote to memory of 1980	1736	regsvr32.exe	rundll32.exe
PID 1736 wrote to memory of 1980	1736	regsvr32.exe	rundll32.exe
PID 1736 wrote to memory of 1980	1736	regsvr32.exe	rundll32.exe
PID 1736 wrote to memory of 1980	1736	regsvr32.exe	rundll32.exe
PID 1736 wrote to memory of 1980	1736	regsvr32.exe	rundll32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Receipt#2019#6dee13ba19fcef2b7b9c5f05086580cb1.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt
2⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\regsvr32.exe
-s C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt,f0
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt
Filesize
1.4MB

MD5
21e8502d416221b2d998133680b8f2b6

SHA1
3efa1f38b2f151cc55cd632a325e888ed262dca6

SHA256
caf2a70ee7b1300b0b88cbe2a594cc0a959f8b1b043c668fde9c20961d60d64f

SHA512
59e88fc5d4c3ddc784daed2ed2e415c86ce4f922bba30b8131aed48a674233593dc23398c8cde8e82a88fa6cd70dd916905530107a547fb34f158b9bdb540efd

Download Submit
\Users\Admin\AppData\Local\Temp\IEeHCa.txt
Filesize
1.4MB

MD5
21e8502d416221b2d998133680b8f2b6

SHA1
3efa1f38b2f151cc55cd632a325e888ed262dca6

SHA256
caf2a70ee7b1300b0b88cbe2a594cc0a959f8b1b043c668fde9c20961d60d64f

SHA512
59e88fc5d4c3ddc784daed2ed2e415c86ce4f922bba30b8131aed48a674233593dc23398c8cde8e82a88fa6cd70dd916905530107a547fb34f158b9bdb540efd

Download Submit
\Users\Admin\AppData\Local\Temp\IEeHCa.txt
Filesize
1.4MB

MD5
21e8502d416221b2d998133680b8f2b6

SHA1
3efa1f38b2f151cc55cd632a325e888ed262dca6

SHA256
caf2a70ee7b1300b0b88cbe2a594cc0a959f8b1b043c668fde9c20961d60d64f

SHA512
59e88fc5d4c3ddc784daed2ed2e415c86ce4f922bba30b8131aed48a674233593dc23398c8cde8e82a88fa6cd70dd916905530107a547fb34f158b9bdb540efd

Download Submit
memory/1280-54-0x0000000000000000-mapping.dmp

Download
memory/1280-55-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Filesize
8KB

Download
memory/1736-57-0x0000000000000000-mapping.dmp

Download
memory/1736-58-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1736-60-0x0000000001DE0000-0x0000000001F50000-memory.dmp

Filesize
1.4MB

Download
memory/1980-61-0x0000000000000000-mapping.dmp

Download
memory/1980-64-0x0000000001F90000-0x0000000002100000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing