danabot | 2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9

General

Target

2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe
Size

3.6MB
MD5

41fe97773c2e2d8600d771510f4c0d00
SHA1

642d9feb83d6afaa6b5f455f617914beedd67556
SHA256

2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9
SHA512

bbc823c37970e45e05ad9a507416b70f21d75caab2420da04171846fef1f04b71c5ad41c9234f3ee9fd1965e48c80846d37ec70f8b0f965c52bf0160d12abb47
SSDEEP

49152:zjvWrU4VyUHA3iRYoySMbSsigAh14tKS2lw4I0LGAEfxQGV3O:3wU4VyUHpRYoESsigAly4

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes

embedded_hash
5DE49C5B1830DF646850D6BE1B93D52D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

3 816 rundll32.exe
4 816 rundll32.exe
5 816 rundll32.exe
8 816 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

816 rundll32.exe
816 rundll32.exe
816 rundll32.exe
816 rundll32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 816 set thread context of 1568 816 rundll32.exe rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

896 1032 WerFault.exe 2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe

flow	pid	process
3	816	rundll32.exe
4	816	rundll32.exe
5	816	rundll32.exe
8	816	rundll32.exe

pid	process
816	rundll32.exe
816	rundll32.exe
816	rundll32.exe
816	rundll32.exe

description	pid	process	target process
PID 816 set thread context of 1568	816	rundll32.exe	rundll32.exe

pid	pid_target	process	target process
896	1032	WerFault.exe	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Modifies registry class 24 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1568 rundll32.exe

pid	process
1568	rundll32.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exerundll32.exe

description	pid	process	target process
PID 1032 wrote to memory of 816	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe
PID 1032 wrote to memory of 816	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe
PID 1032 wrote to memory of 816	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe
PID 1032 wrote to memory of 816	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe
PID 1032 wrote to memory of 816	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe
PID 1032 wrote to memory of 816	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe
PID 1032 wrote to memory of 816	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe
PID 1032 wrote to memory of 896	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	WerFault.exe
PID 1032 wrote to memory of 896	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	WerFault.exe
PID 1032 wrote to memory of 896	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	WerFault.exe
PID 1032 wrote to memory of 896	1032	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	WerFault.exe
PID 816 wrote to memory of 1568	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 1568	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 1568	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 1568	816	rundll32.exe	rundll32.exe
PID 816 wrote to memory of 1568	816	rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe
"C:\Users\Admin\AppData\Local\Temp\2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20219
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 208
2⤵
- Program crash
PID:896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
06b68cd341d1e72c84d8d5b88d7a5eed

SHA1
5f140931ad238a37c65a4f920d5a839d58cd3781

SHA256
db96916fc36c326fbecc1ecfb832e2751294d0e44015a9a182c7f77f39f54abe

SHA512
ebf68f7287db9f01682e3e12414b53d08c4c685a4e0f400513f7ab8305ae1f0f5b636c8e4276789ccf379bf4c57c01e62bda81b8eadbd2adcda59bc7b3413347

Download Submit
\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
06b68cd341d1e72c84d8d5b88d7a5eed

SHA1
5f140931ad238a37c65a4f920d5a839d58cd3781

SHA256
db96916fc36c326fbecc1ecfb832e2751294d0e44015a9a182c7f77f39f54abe

SHA512
ebf68f7287db9f01682e3e12414b53d08c4c685a4e0f400513f7ab8305ae1f0f5b636c8e4276789ccf379bf4c57c01e62bda81b8eadbd2adcda59bc7b3413347

Download Submit
\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
06b68cd341d1e72c84d8d5b88d7a5eed

SHA1
5f140931ad238a37c65a4f920d5a839d58cd3781

SHA256
db96916fc36c326fbecc1ecfb832e2751294d0e44015a9a182c7f77f39f54abe

SHA512
ebf68f7287db9f01682e3e12414b53d08c4c685a4e0f400513f7ab8305ae1f0f5b636c8e4276789ccf379bf4c57c01e62bda81b8eadbd2adcda59bc7b3413347

Download Submit
\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
06b68cd341d1e72c84d8d5b88d7a5eed

SHA1
5f140931ad238a37c65a4f920d5a839d58cd3781

SHA256
db96916fc36c326fbecc1ecfb832e2751294d0e44015a9a182c7f77f39f54abe

SHA512
ebf68f7287db9f01682e3e12414b53d08c4c685a4e0f400513f7ab8305ae1f0f5b636c8e4276789ccf379bf4c57c01e62bda81b8eadbd2adcda59bc7b3413347

Download Submit
\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
06b68cd341d1e72c84d8d5b88d7a5eed

SHA1
5f140931ad238a37c65a4f920d5a839d58cd3781

SHA256
db96916fc36c326fbecc1ecfb832e2751294d0e44015a9a182c7f77f39f54abe

SHA512
ebf68f7287db9f01682e3e12414b53d08c4c685a4e0f400513f7ab8305ae1f0f5b636c8e4276789ccf379bf4c57c01e62bda81b8eadbd2adcda59bc7b3413347

Download Submit
memory/816-70-0x0000000003390000-0x0000000003AB5000-memory.dmp

Filesize
7.1MB

Download
memory/816-71-0x0000000003B80000-0x0000000003CC0000-memory.dmp

Filesize
1.2MB

Download
memory/816-63-0x0000000001F50000-0x00000000021C1000-memory.dmp

Filesize
2.4MB

Download
memory/816-55-0x0000000000000000-mapping.dmp

Download
memory/816-64-0x0000000001F50000-0x00000000021C1000-memory.dmp

Filesize
2.4MB

Download
memory/816-65-0x0000000001F50000-0x00000000021C1000-memory.dmp

Filesize
2.4MB

Download
memory/816-66-0x0000000003390000-0x0000000003AB5000-memory.dmp

Filesize
7.1MB

Download
memory/816-67-0x0000000003390000-0x0000000003AB5000-memory.dmp

Filesize
7.1MB

Download
memory/816-69-0x0000000003390000-0x0000000003AB5000-memory.dmp

Filesize
7.1MB

Download
memory/816-85-0x0000000003390000-0x0000000003AB5000-memory.dmp

Filesize
7.1MB

Download
memory/816-72-0x0000000003B80000-0x0000000003CC0000-memory.dmp

Filesize
1.2MB

Download
memory/816-78-0x0000000003B80000-0x0000000003CC0000-memory.dmp

Filesize
1.2MB

Download
memory/816-73-0x0000000003B80000-0x0000000003CC0000-memory.dmp

Filesize
1.2MB

Download
memory/816-77-0x0000000003B80000-0x0000000003CC0000-memory.dmp

Filesize
1.2MB

Download
memory/816-76-0x0000000003B80000-0x0000000003CC0000-memory.dmp

Filesize
1.2MB

Download
memory/896-62-0x0000000000000000-mapping.dmp

Download
memory/1032-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1568-74-0x0000000000230000-0x0000000000449000-memory.dmp

Filesize
2.1MB

Download
memory/1568-79-0x00000000FF5D3CEC-mapping.dmp

Download
memory/1568-80-0x0000000001E00000-0x0000000001F40000-memory.dmp

Filesize
1.2MB

Download
memory/1568-81-0x0000000001E00000-0x0000000001F40000-memory.dmp

Filesize
1.2MB

Download
memory/1568-82-0x000007FEFC581000-0x000007FEFC583000-memory.dmp

Filesize
8KB

Download
memory/1568-83-0x0000000000230000-0x0000000000449000-memory.dmp

Filesize
2.1MB

Download
memory/1568-84-0x0000000001FE0000-0x000000000220A000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads