danabot | e13640666585c0e82d6cc9f3d2dc3a3da66c3a852b646d59bb7cfa97cc39bffd

General

Target

malware_smoke_3061005942.exe
Size

1.1MB
MD5

2141a496f9a9d04a7a28caef9e888fed
SHA1

9aa0b33782f87c1c3c77c27c877cb2bb60b4ab5f
SHA256

e13640666585c0e82d6cc9f3d2dc3a3da66c3a852b646d59bb7cfa97cc39bffd
SHA512

80f26f43c73b3a5d336a118e3caec0713f9c9d1df5980534887e8d8fd3a9a1bf2008628e9f425b861baa288df727e60cef482f0b33518eddf861d396bcb19d80
SSDEEP

24576:9TwAQDab31LuMbTAf0ZldVmo9I/wQXQihcbDhY7OY:9T716MbTrZtxQXQ+8hEOY

Score

10^/10

danabot 5 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

5

C2

23.106.122.14:443

5.9.224.217:443

192.236.161.4:443

Attributes

embedded_hash
02CDE3C5209428051C9FFF92782DB49C
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

31 4264 rundll32.exe
43 4264 rundll32.exe
44 4264 rundll32.exe
45 4264 rundll32.exe
47 4264 rundll32.exe
48 4264 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4796 5080 WerFault.exe malware_smoke_3061005942.exe

flow	pid	process
31	4264	rundll32.exe
43	4264	rundll32.exe
44	4264	rundll32.exe
45	4264	rundll32.exe
47	4264	rundll32.exe
48	4264	rundll32.exe

pid	pid_target	process	target process
4796	5080	WerFault.exe	malware_smoke_3061005942.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

malware_smoke_3061005942.exe

description	pid	process	target process
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe
PID 5080 wrote to memory of 4264	5080	malware_smoke_3061005942.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\malware_smoke_3061005942.exe
"C:\Users\Admin\AppData\Local\Temp\malware_smoke_3061005942.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
2⤵
- Blocklisted process makes network request
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 608
2⤵
- Program crash
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5080 -ip 5080
1⤵
PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4264-149-0x0000000000840000-0x0000000000843000-memory.dmp

Filesize
12KB

Download
memory/4264-153-0x0000000000880000-0x0000000000883000-memory.dmp

Filesize
12KB

Download
memory/4264-143-0x00000000005E0000-0x00000000005E3000-memory.dmp

Filesize
12KB

Download
memory/4264-142-0x00000000005D0000-0x00000000005D3000-memory.dmp

Filesize
12KB

Download
memory/4264-145-0x0000000000800000-0x0000000000803000-memory.dmp

Filesize
12KB

Download
memory/4264-146-0x0000000000810000-0x0000000000813000-memory.dmp

Filesize
12KB

Download
memory/4264-138-0x0000000000000000-mapping.dmp

Download
memory/4264-139-0x00000000005A0000-0x00000000005A3000-memory.dmp

Filesize
12KB

Download
memory/4264-152-0x0000000000870000-0x0000000000873000-memory.dmp

Filesize
12KB

Download
memory/4264-141-0x00000000005C0000-0x00000000005C3000-memory.dmp

Filesize
12KB

Download
memory/4264-144-0x00000000005F0000-0x00000000005F3000-memory.dmp

Filesize
12KB

Download
memory/4264-147-0x0000000000820000-0x0000000000823000-memory.dmp

Filesize
12KB

Download
memory/4264-140-0x00000000005B0000-0x00000000005B3000-memory.dmp

Filesize
12KB

Download
memory/4264-151-0x0000000000860000-0x0000000000863000-memory.dmp

Filesize
12KB

Download
memory/4264-150-0x0000000000850000-0x0000000000853000-memory.dmp

Filesize
12KB

Download
memory/4264-148-0x0000000000830000-0x0000000000833000-memory.dmp

Filesize
12KB

Download
memory/5080-133-0x0000000002640000-0x0000000002889000-memory.dmp

Filesize
2.3MB

Download
memory/5080-132-0x0000000002550000-0x000000000263B000-memory.dmp

Filesize
940KB

Download
memory/5080-134-0x0000000000400000-0x000000000072D000-memory.dmp

Filesize
3.2MB

Download
memory/5080-137-0x0000000000400000-0x000000000072D000-memory.dmp

Filesize
3.2MB

Download
memory/5080-136-0x0000000002640000-0x0000000002889000-memory.dmp

Filesize
2.3MB

Download
memory/5080-135-0x0000000000400000-0x000000000072D000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads