danabot | c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe

Analysis

max time kernel
145s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
26-09-2022 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe
Size

1.2MB
MD5

81735609cd3f79775e72f0f8159c6b05
SHA1

b7d5bf75c2a081b0718ac2dcce1c67699a6303bd
SHA256

c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe
SHA512

093f8bb8f3cb2d3cb184a76f3ab17b3398a568bdbedfd4f29a98c9fa32d8e932f26fe1ee41658070c6569f0cd793bde9c00cf7dd6c814ba6067716f11340939b
SSDEEP

24576:TmPoE/J5AlZQtk51tMiRJaxXdtFeL+I/eVGoGuN6Q+N+i:TmPofHOk51tM4wLq+wQtaQ+k

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3300	2700	WerFault.exe	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe
3592	2700	WerFault.exe	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe

description	pid	process	target process
PID 2700 wrote to memory of 4472	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	appidtel.exe
PID 2700 wrote to memory of 4472	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	appidtel.exe
PID 2700 wrote to memory of 4472	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	appidtel.exe
PID 2700 wrote to memory of 3544	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	rundll32.exe
PID 2700 wrote to memory of 3544	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	rundll32.exe
PID 2700 wrote to memory of 3544	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	rundll32.exe
PID 2700 wrote to memory of 3544	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	rundll32.exe
PID 2700 wrote to memory of 3544	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	rundll32.exe
PID 2700 wrote to memory of 3544	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	rundll32.exe
PID 2700 wrote to memory of 3544	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	rundll32.exe
PID 2700 wrote to memory of 3544	2700	c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe
"C:\Users\Admin\AppData\Local\Temp\c14de788a761dfd477739bdfe4b5879e8ef13027bb1325741ac05414908b63fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\appidtel.exe
  C:\Windows\system32\appidtel.exe
  2⤵
  PID:4472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 604
  2⤵
  - Program crash
  PID:3300
- C:\Windows\syswow64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 588
  2⤵
  - Program crash
  PID:3592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-178-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2700-116-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-161-0x0000000002440000-0x0000000002572000-memory.dmp

Filesize
1.2MB

Download
memory/2700-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-123-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-139-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-140-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-142-0x0000000002440000-0x0000000002572000-memory.dmp

Filesize
1.2MB

Download
memory/2700-143-0x0000000002630000-0x000000000290B000-memory.dmp

Filesize
2.9MB

Download
memory/2700-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-118-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-117-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-120-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-162-0x0000000002630000-0x000000000290B000-memory.dmp

Filesize
2.9MB

Download
memory/2700-163-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2700-164-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2700-153-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2700-177-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-176-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-175-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-174-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-173-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-172-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-171-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/2700-165-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-166-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-167-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-168-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-169-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-170-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-157-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-155-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-154-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-150-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-148-0x0000000000000000-mapping.dmp

Download
memory/4472-156-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-158-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-159-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-160-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download