danabot | 9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7

Analysis

max time kernel
142s
max time network
167s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
02/10/2022, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe
Size

1.2MB
MD5

aa2864ecd1726dad6da205ada6caa5ea
SHA1

6af6da5cadfb451a4cdaa3c883d22a3035264f9c
SHA256

9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7
SHA512

467c7fb9501ef93f8c17cde064ef5649a27f6861cb5b561128a0c89387bd28e684ca2fcb0aa1c13e49e5a9d972fdeac47664255e50d9694d93a19e0b4e9125bf
SSDEEP

24576:mIof08Wjll6L5Ou2V15buSeME4ybfK0h272ppe0pjIlZ+vWwcUO:mIoMfjn6LwdySefjmf72bfjm6c

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

192.236.233.188:443

192.119.70.159:443

23.106.124.171:443

Attributes

embedded_hash
F11D3871631E16E8DE15C24B32328D98
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4152	2576	WerFault.exe	65
5088	2576	WerFault.exe	65

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 3932	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	66
PID 2576 wrote to memory of 3932	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	66
PID 2576 wrote to memory of 3932	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	66
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69
PID 2576 wrote to memory of 2808	2576	9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe	69

C:\Users\Admin\AppData\Local\Temp\9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe
"C:\Users\Admin\AppData\Local\Temp\9cc4d2b884d5653bc627c3c02512195dac5da3a92bb38b918deb2d7cc68256f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\appidtel.exe
  C:\Windows\system32\appidtel.exe
  2⤵
  PID:3932
- C:\Windows\syswow64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  PID:2808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 604
  2⤵
  - Program crash
  PID:4152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 572
  2⤵
  - Program crash
  PID:5088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-164-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/2576-162-0x00000000026A0000-0x000000000295B000-memory.dmp

Filesize
2.7MB

Download
memory/2576-117-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-118-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-119-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-120-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-121-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-122-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-123-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-124-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-125-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-126-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-127-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-128-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-129-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-130-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-131-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-132-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-133-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-134-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-135-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-137-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-138-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-139-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-140-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-141-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-142-0x00000000024C0000-0x00000000025E9000-memory.dmp

Filesize
1.2MB

Download
memory/2576-143-0x00000000026A0000-0x000000000295B000-memory.dmp

Filesize
2.7MB

Download
memory/2576-144-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-145-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-116-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-179-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-178-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-147-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-177-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/2576-176-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-153-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/2576-175-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-174-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-173-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-172-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-171-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-170-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-169-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-168-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-161-0x00000000024C0000-0x00000000025E9000-memory.dmp

Filesize
1.2MB

Download
memory/2576-146-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-163-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/2576-115-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-165-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/2576-166-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/2576-167-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-160-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-159-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-158-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-157-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-155-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-154-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-152-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-151-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-150-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-156-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download
memory/3932-149-0x00000000775B0000-0x000000007773E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads