danabot | 3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc

General

Target

3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe
Size

1.3MB
MD5

7a14f2a7902fd7f1199cf3adb6bc77e5
SHA1

2036574d84573d0399b2968dc32e5b52437ecdd5
SHA256

3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc
SHA512

c64b643ec38978c9ce4d810689b4eb9569d1f948c78434a0e469e4d9e597cb50c89f0d3b3b8bbe7e17735f9f40f2ed29ea88ea9958c5da33c7751e3502101324
SSDEEP

24576:1allXB6VDoqMmi044AKIYqAKqIZIXlYBrL+Jj6sxY0wDxML/R:UlD6VDoki0jNqA1IZaYl+j6sCo

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4764	2676	WerFault.exe	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe
3480	2676	WerFault.exe	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe

description	pid	process	target process
PID 2676 wrote to memory of 4796	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	appidtel.exe
PID 2676 wrote to memory of 4796	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	appidtel.exe
PID 2676 wrote to memory of 4796	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	appidtel.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe
PID 2676 wrote to memory of 4300	2676	3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe
"C:\Users\Admin\AppData\Local\Temp\3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\appidtel.exe
C:\Windows\system32\appidtel.exe
2⤵
PID:4796

C:\Windows\syswow64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
2⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 600
2⤵
- Program crash
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 624
2⤵
- Program crash
PID:3480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-147-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-116-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-118-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-119-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-146-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-121-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-122-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-123-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-124-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-125-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-126-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-127-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-128-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-129-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-130-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-132-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-133-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-134-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-135-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-136-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-137-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-139-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-141-0x0000000002650000-0x000000000292B000-memory.dmp

Filesize
2.9MB

Download
memory/2676-140-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-138-0x00000000024A0000-0x00000000025C7000-memory.dmp

Filesize
1.2MB

Download
memory/2676-142-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-143-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-144-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-145-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-120-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-117-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-160-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2676-161-0x0000000002650000-0x000000000292B000-memory.dmp

Filesize
2.9MB

Download
memory/2676-162-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2676-163-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2676-164-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-176-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2676-175-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-174-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-173-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-172-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-171-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-170-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-165-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-166-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-168-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2676-167-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-169-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-154-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-153-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-152-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-151-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-150-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-149-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-148-0x0000000000000000-mapping.dmp

Download
memory/4796-155-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-156-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-157-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-158-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4796-159-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing