danabot | 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a

Analysis

max time kernel
199s
max time network
180s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
12/10/2022, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe
Size

1.2MB
MD5

20414be8ceb675059f5fb9d2f656e7b9
SHA1

5dbd2930909ef93772b592a6fc3452ce173b1a63
SHA256

9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a
SHA512

15f78877242404125e50bcfc9989d1b906daea2a4f9feb4b067900fefe62e91eb74492938d06c123e37fa8ff46789216d2d6797c9ba4aa72161aee331c85b2d5
SSDEEP

24576:dXvVcG5KIkfbO8FuS/uWFYHLss1kLIM6VPdzMcGEcdoV8Kv:dXvVJPibx/rFYHwswInVPdIRRdhKv

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

192.236.233.188:443

192.119.70.159:443

23.106.124.171:443

Attributes

embedded_hash
F11D3871631E16E8DE15C24B32328D98
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1932	4240	WerFault.exe	29
3656	4240	WerFault.exe	29
1540	4240	WerFault.exe	29

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 5096	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	67
PID 4240 wrote to memory of 5096	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	67
PID 4240 wrote to memory of 5096	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	67
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68
PID 4240 wrote to memory of 4036	4240	9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe	68

C:\Users\Admin\AppData\Local\Temp\9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe
"C:\Users\Admin\AppData\Local\Temp\9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\appidtel.exe
  C:\Windows\system32\appidtel.exe
  2⤵
  PID:5096
- C:\Windows\syswow64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  PID:4036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 632
  2⤵
  - Program crash
  PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 620
  2⤵
  - Program crash
  PID:3656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 688
  2⤵
  - Program crash
  PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4240-168-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-166-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/4240-122-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-121-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-123-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-124-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-125-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-127-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-126-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-128-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-129-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-130-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-131-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-132-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-134-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-135-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-136-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-137-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-138-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-139-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-133-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-141-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-142-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-143-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-144-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-145-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-146-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-147-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-148-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-149-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-120-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-183-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/4240-182-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-181-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-180-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-179-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-178-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-177-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-176-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-175-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-174-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-173-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-162-0x00000000024E0000-0x00000000025FE000-memory.dmp

Filesize
1.1MB

Download
memory/4240-163-0x0000000002600000-0x00000000028BB000-memory.dmp

Filesize
2.7MB

Download
memory/4240-164-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/4240-165-0x00000000024E0000-0x00000000025FE000-memory.dmp

Filesize
1.1MB

Download
memory/4240-172-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-167-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-119-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-169-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-170-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/4240-171-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-151-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-154-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-157-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-158-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-160-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-161-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-159-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-156-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-153-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-155-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/5096-152-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads