danabot | dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028

General

Target

dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe
Size

1.3MB
MD5

1c4b7ed2eb6ce196468f88be8a163f59
SHA1

978a72fde9c7dbfd7f660714bbc81c3cd5231735
SHA256

dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028
SHA512

111ba7fb637f4c02d08a750f656d16aacddd42e328784a330ecfb936a6e68b7b24a5e8be10a313ea943dbc45d9cf1b06c656ed548462719b101ecaad0de1d119
SSDEEP

24576:9nOHlC9jLVh+MuCuSRpwQXU0kgMQw9TD49oD:tOnBSUXQw9SoD

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3572	2740	WerFault.exe	dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe
2028	2740	WerFault.exe	dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe

description	pid	process	target process
PID 2740 wrote to memory of 960	2740	dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe	appidtel.exe
PID 2740 wrote to memory of 960	2740	dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe	appidtel.exe
PID 2740 wrote to memory of 960	2740	dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe	appidtel.exe
PID 2740 wrote to memory of 3312	2740	dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe	rundll32.exe
PID 2740 wrote to memory of 3312	2740	dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe	rundll32.exe
PID 2740 wrote to memory of 3312	2740	dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe	rundll32.exe
PID 2740 wrote to memory of 3312	2740	dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe
"C:\Users\Admin\AppData\Local\Temp\dd8f4f5fba1053b26b3622f83917751fc4513f3af73dafda36d4dbd33c732028.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\appidtel.exe
C:\Windows\system32\appidtel.exe
2⤵
PID:960

C:\Windows\syswow64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
2⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 600
2⤵
- Program crash
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 624
2⤵
- Program crash
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-148-0x0000000000000000-mapping.dmp

Download
memory/960-160-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-159-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-158-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-157-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-156-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-155-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-154-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-152-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-150-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-151-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/960-149-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-146-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-124-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-130-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-132-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-133-0x0000000002600000-0x0000000002735000-memory.dmp

Filesize
1.2MB

Download
memory/2740-134-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-135-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-136-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-137-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-139-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-138-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-140-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-141-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-142-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-143-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-144-0x0000000002740000-0x0000000002A1B000-memory.dmp

Filesize
2.9MB

Download
memory/2740-145-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-116-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-147-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-128-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-127-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-126-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-121-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-125-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-153-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2740-129-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-123-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-122-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-120-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-119-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-118-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-117-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-161-0x0000000002600000-0x0000000002735000-memory.dmp

Filesize
1.2MB

Download
memory/2740-162-0x0000000002740000-0x0000000002A1B000-memory.dmp

Filesize
2.9MB

Download
memory/2740-163-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2740-164-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2740-165-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-166-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-167-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-169-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2740-168-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-170-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-171-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-172-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-173-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-174-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-175-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-176-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/2740-177-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing