danabot | 2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5

Analysis

max time kernel
146s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
25/09/2022, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe
Size

1.3MB
MD5

ed3c7179943462af3b79b62ce59b7ad5
SHA1

5b869c5f70c5a50014e431f3fca0b4efe6aef812
SHA256

2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5
SHA512

3a907731639048b23b8995e13dd0de4ca38fdea76d2bb1f07f82eee2ca382eb4408530dee2f482c89dee06af6a1966cccbf800b48e3cb9ed25d8952fb1732346
SSDEEP

24576:fErYJBXOFx6VGyd54z+pOTCrOGrWyUgxVNs74V76ZCTcteI3n+vy5np99ye:vBXOwGH+oTCrOGiyU2s787CCTcII3n+q

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1448	5004	WerFault.exe	65
4260	5004	WerFault.exe	65

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1944	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	66
PID 5004 wrote to memory of 1944	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	66
PID 5004 wrote to memory of 1944	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	66
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69
PID 5004 wrote to memory of 1064	5004	2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe	69

C:\Users\Admin\AppData\Local\Temp\2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe
"C:\Users\Admin\AppData\Local\Temp\2de605ca0185b5bbad3f5b19aa6a20d43c5fc3d01fde3717d5a445ff3e408ac5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\appidtel.exe
  C:\Windows\system32\appidtel.exe
  2⤵
  PID:1944
- C:\Windows\syswow64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 604
  2⤵
  - Program crash
  PID:1448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 636
  2⤵
  - Program crash
  PID:4260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-159-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-158-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-156-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-155-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-154-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-153-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-152-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-151-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-150-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-149-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-148-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-145-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-121-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-129-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-131-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-132-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-133-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-135-0x0000000002490000-0x00000000025BA000-memory.dmp

Filesize
1.2MB

Download
memory/5004-136-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-137-0x00000000025C0000-0x000000000289B000-memory.dmp

Filesize
2.9MB

Download
memory/5004-138-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-139-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-134-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-140-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-141-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-142-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-143-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-144-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-115-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-146-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-127-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-126-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-125-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-124-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-123-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-122-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-128-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-120-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-119-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-118-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-117-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-157-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/5004-116-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-160-0x0000000002490000-0x00000000025BA000-memory.dmp

Filesize
1.2MB

Download
memory/5004-161-0x00000000025C0000-0x000000000289B000-memory.dmp

Filesize
2.9MB

Download
memory/5004-162-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/5004-163-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/5004-164-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-165-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-166-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/5004-167-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-168-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-169-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-170-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-171-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-172-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-173-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-174-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-175-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5004-176-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads