danabot | bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91

Analysis

max time kernel
87s
max time network
144s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
14/10/2022, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe
Size

1.3MB
MD5

cd95bb189447051cbe0ad7830a25b599
SHA1

6a3aa2f733f9c9bfbb59b8f380b9486f32d8d68b
SHA256

bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91
SHA512

2ebcbd14376dae560eea8802e07076f348c89c04cb0b7f3ecdfcf7947bd7ae754c05b9c2ec976b05f110502a05e05567a49d0551ab22b3675115b1854eb54ccf
SSDEEP

24576:efjhHcDV/+qJTr3TkI34OOD2vzjUWhGf/ft:efj6DV/vlDka4Nfnt

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

192.236.233.188:443

192.119.70.159:443

23.106.124.171:443

213.227.155.103:443

Attributes

embedded_hash
56951C922035D696BFCE443750496462
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3308	388	WerFault.exe	65
5008	388	WerFault.exe	65

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2084	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	66
PID 388 wrote to memory of 2084	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	66
PID 388 wrote to memory of 2084	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	66
PID 388 wrote to memory of 2336	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	69
PID 388 wrote to memory of 2336	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	69
PID 388 wrote to memory of 2336	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	69
PID 388 wrote to memory of 2336	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	69
PID 388 wrote to memory of 2336	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	69
PID 388 wrote to memory of 2336	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	69
PID 388 wrote to memory of 2336	388	bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe	69

C:\Users\Admin\AppData\Local\Temp\bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe
"C:\Users\Admin\AppData\Local\Temp\bb3fccd4c294700226e14bcc586ff0aff7aacc5937909e6f34ffa4c606274e91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\appidtel.exe
  C:\Windows\system32\appidtel.exe
  2⤵
  PID:2084
- C:\Windows\syswow64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 620
  2⤵
  - Program crash
  PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 596
  2⤵
  - Program crash
  PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-151-0x0000000002440000-0x000000000256B000-memory.dmp

Filesize
1.2MB

Download
memory/388-135-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-121-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-123-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-124-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-125-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-126-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-127-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-128-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-129-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-130-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-131-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-132-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-133-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-134-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-153-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/388-136-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-137-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-138-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-139-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-140-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-141-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-142-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-143-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-145-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-146-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-147-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-148-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-149-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-150-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-122-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-183-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/388-120-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-182-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-152-0x0000000002570000-0x0000000002832000-memory.dmp

Filesize
2.8MB

Download
memory/388-181-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-180-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-179-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-178-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-177-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-176-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-175-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-174-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-173-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-171-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-166-0x0000000002440000-0x000000000256B000-memory.dmp

Filesize
1.2MB

Download
memory/388-167-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/388-168-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/388-169-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-170-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/388-172-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/2084-165-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-164-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-163-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-162-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-161-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-160-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-159-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-158-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-157-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-156-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-155-0x00000000772B0000-0x000000007743E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads