danabot | d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048

General

Target

d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe
Size

1.3MB
MD5

ce4ad3f233333397580843b56b17eaa4
SHA1

2ec3e070183b26af6dd8afe63d0bebb9e3c8b902
SHA256

d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048
SHA512

06275470139a17f23f4bcd93b06514e71ee40e9ee44ebda5d28b6d6c94af687d29346210cc127b5bec1ec657326fea109afdb6172319393855a4ea352388fb43
SSDEEP

24576:Vs8riw1bDVwgFbotKsDKT0wzLhL7bUJ3a+Jx9/I96TXvSisTOixM1p6juZJo:Le2VVKK30wzlrkK+CMXvH44f6aZ

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
5088	2748	WerFault.exe	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe
1420	2748	WerFault.exe	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe

description	pid	process	target process
PID 2748 wrote to memory of 4524	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	appidtel.exe
PID 2748 wrote to memory of 4524	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	appidtel.exe
PID 2748 wrote to memory of 4524	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	appidtel.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe
PID 2748 wrote to memory of 3420	2748	d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe
"C:\Users\Admin\AppData\Local\Temp\d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\SysWOW64\appidtel.exe
C:\Windows\system32\appidtel.exe
2⤵
PID:4524

C:\Windows\syswow64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
2⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 604
2⤵
- Program crash
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 636
2⤵
- Program crash
PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-146-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-122-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-117-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-118-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-119-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-120-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-121-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-115-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-123-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-124-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-125-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-126-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-127-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-128-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-129-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-131-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-132-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-133-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-134-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-135-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-137-0x0000000002440000-0x000000000256D000-memory.dmp

Filesize
1.2MB

Download
memory/2748-138-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-139-0x0000000002570000-0x000000000284B000-memory.dmp

Filesize
2.9MB

Download
memory/2748-136-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-140-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-141-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-142-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-143-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-144-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-145-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-160-0x0000000002440000-0x000000000256D000-memory.dmp

Filesize
1.2MB

Download
memory/2748-158-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2748-116-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-161-0x0000000002570000-0x000000000284B000-memory.dmp

Filesize
2.9MB

Download
memory/2748-162-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2748-163-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2748-176-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2748-175-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-174-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-173-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-172-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-171-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-169-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-164-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-165-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-166-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-167-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-168-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-170-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/4524-153-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-152-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-151-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-150-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-149-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-148-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-147-0x0000000000000000-mapping.dmp

Download
memory/4524-154-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-155-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-156-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-157-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4524-159-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing