danabot | 2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d

Analysis

max time kernel
156s
max time network
169s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03-10-2022 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe
Size

1.2MB
MD5

e17e5a18e6bd934ae53ab90ddde3d9e4
SHA1

804ed2db85bc6360b667b17272b250761cfe1841
SHA256

2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d
SHA512

3e3efa121b5c49e6ce73e0813261fae0cc03fa3f5fd41a938905c112961138aae5df4a8531df4f7ca24dc06350162eb0caa549851910bb278dbcbba5570abc33
SSDEEP

24576:kaFcQrjgAfwWbpxdEJEEdkrOf8mbIzRjUEK6BiiQ0ThvIC05uB:kfQrjgAtmQm8mMz+EKAiiv1AWB

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

192.236.233.188:443

192.119.70.159:443

23.106.124.171:443

Attributes

embedded_hash
F11D3871631E16E8DE15C24B32328D98
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4344	2748	WerFault.exe	65
4196	2748	WerFault.exe	65

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1488	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	66
PID 2748 wrote to memory of 1488	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	66
PID 2748 wrote to memory of 1488	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	66
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69
PID 2748 wrote to memory of 4408	2748	2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe	69

C:\Users\Admin\AppData\Local\Temp\2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe
"C:\Users\Admin\AppData\Local\Temp\2777647da697019ed878d27d6e9bc82ea97d4efbaddd8c8a270822fd8999929d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\appidtel.exe
  C:\Windows\system32\appidtel.exe
  2⤵
  PID:1488
- C:\Windows\syswow64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  PID:4408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 604
  2⤵
  - Program crash
  PID:4344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 604
  2⤵
  - Program crash
  PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-149-0x0000000000000000-mapping.dmp

Download
memory/1488-161-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-160-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-155-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-159-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-158-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-157-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-154-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-153-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-152-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-151-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/1488-150-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-132-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-123-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-130-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-131-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-116-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-133-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-134-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-135-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-136-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-138-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-139-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-140-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-141-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-142-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-143-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-144-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-146-0x00000000024A0000-0x00000000025C7000-memory.dmp

Filesize
1.2MB

Download
memory/2748-145-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-147-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-148-0x00000000025D0000-0x000000000288B000-memory.dmp

Filesize
2.7MB

Download
memory/2748-128-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-127-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-126-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-125-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-124-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-129-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-122-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-121-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-156-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/2748-120-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-119-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-118-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-117-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-162-0x00000000024A0000-0x00000000025C7000-memory.dmp

Filesize
1.2MB

Download
memory/2748-163-0x00000000025D0000-0x000000000288B000-memory.dmp

Filesize
2.7MB

Download
memory/2748-164-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/2748-165-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/2748-166-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/2748-167-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-168-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-169-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-170-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-171-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-172-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-173-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-174-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-175-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-176-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-177-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-178-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-179-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2748-180-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads