danabot | 61113d3e16d65cc74d36073b51da8c3c9f9aac38a8c1b5f52cf37d0ab80087b1

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2022 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rechnung_DHL_00069290444019.vbs
Size

1.4MB
MD5

1ef8b148b1b51343c3150d5dad342d3e
SHA1

3d554440983f890cda93149bc4cbfdfad9ac6f3e
SHA256

7b50c5555749ee419657fb8d40a9a1c6e2f103df413ddd53eadd22917ca15ad2
SHA512

bedcea3dd21f8772932ac96c26297e7b4823492679af39b0d9d640592d0648f192c7fe78aedf816e5c2acc75c71989a7605d9daf0193a9d2cd099dcc71e3d692

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

185.43.196.194

170.36.230.93

25.125.161.14

152.163.122.91

252.243.36.124

94.2.203.24

95.179.186.57

58.41.130.190

89.144.25.104

182.54.114.216

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 3 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral2/files/0x0006000000022f3b-131.dat	family_danabot
behavioral2/files/0x0006000000022f3b-133.dat	family_danabot
behavioral2/files/0x0006000000022f3b-135.dat	family_danabot

Blocklisted process makes network request 8 IoCs

flow	pid	Process
20	680	rundll32.exe
34	680	rundll32.exe
57	680	rundll32.exe
69	680	rundll32.exe
70	680	rundll32.exe
71	680	rundll32.exe
72	680	rundll32.exe
74	680	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 2 IoCs

pid	Process
4984	regsvr32.exe
680	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
4984	regsvr32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe
680	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4744	4308	WScript.exe	87
PID 4308 wrote to memory of 4744	4308	WScript.exe	87
PID 4744 wrote to memory of 4984	4744	regsvr32.exe	88
PID 4744 wrote to memory of 4984	4744	regsvr32.exe	88
PID 4744 wrote to memory of 4984	4744	regsvr32.exe	88
PID 4984 wrote to memory of 680	4984	regsvr32.exe	89
PID 4984 wrote to memory of 680	4984	regsvr32.exe	89
PID 4984 wrote to memory of 680	4984	regsvr32.exe	89

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rechnung_DHL_00069290444019.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\jMoOIm.dllHRasUY
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\regsvr32.exe
    -s C:\Users\Admin\AppData\Local\Temp\\jMoOIm.dllHRasUY
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUY,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUY

Filesize
460KB

MD5
8cfa24ff327f06f81438f02181c5b790

SHA1
ccdf5f2aa6d6f920e468b89f1d45ce1cb758ff5e

SHA256
6023fd184fb320359e014eb62c4ca4d673c390c58331bc3a4c1fdc49cc4ba55f

SHA512
ae2da82a1c8efb4795f4c7396e52f6bb41d3b772fad5bb98287845d186d1d052d5f7532b46966e72b517dafbd5fea7e9f4b56f8dd6c76905c5b442f6f71b6e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUY

Filesize
460KB

MD5
8cfa24ff327f06f81438f02181c5b790

SHA1
ccdf5f2aa6d6f920e468b89f1d45ce1cb758ff5e

SHA256
6023fd184fb320359e014eb62c4ca4d673c390c58331bc3a4c1fdc49cc4ba55f

SHA512
ae2da82a1c8efb4795f4c7396e52f6bb41d3b772fad5bb98287845d186d1d052d5f7532b46966e72b517dafbd5fea7e9f4b56f8dd6c76905c5b442f6f71b6e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUY

Filesize
460KB

MD5
8cfa24ff327f06f81438f02181c5b790

SHA1
ccdf5f2aa6d6f920e468b89f1d45ce1cb758ff5e

SHA256
6023fd184fb320359e014eb62c4ca4d673c390c58331bc3a4c1fdc49cc4ba55f

SHA512
ae2da82a1c8efb4795f4c7396e52f6bb41d3b772fad5bb98287845d186d1d052d5f7532b46966e72b517dafbd5fea7e9f4b56f8dd6c76905c5b442f6f71b6e19

Download Submit
memory/680-134-0x0000000000000000-mapping.dmp

Download
memory/4744-130-0x0000000000000000-mapping.dmp

Download
memory/4984-132-0x0000000000000000-mapping.dmp

Download