danabot | 39d9c0de3117b7c40a61ca01e0a3f9144be9236e0918eae950121c13250b529e

Analysis

max time kernel
178s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcefa9f449147383a7af69701c94f5fc.dll
Size

2.3MB
MD5

bcefa9f449147383a7af69701c94f5fc
SHA1

30d857b7babc1da2c663034c393276a940df2ebe
SHA256

39d9c0de3117b7c40a61ca01e0a3f9144be9236e0918eae950121c13250b529e
SHA512

34e9e8f22db182505a6f1338403fe1b6d1c3a9bc54963fc3c799a03e73dbef98950bc314a236423bdfd61afeb959eb34aa904efa367639d74d00482ffcf8ce15
SSDEEP

49152:HhKuFUNe7igoCT4rjd+UYoARFiChl+pg/OtJAS5NjOE7fMXz6q0f:SGuFQo8FiChNOYqh7A

Score

10^/10

danabot 11 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

139.59.105.161:443

35.240.181.236:443

Attributes

embedded_hash
A7F76C8DA744F4E54810724819AFFFE9
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3240-52-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-53-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-54-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-55-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-57-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-58-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-59-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-60-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-61-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-62-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-63-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-64-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-65-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-66-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-67-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021
behavioral2/memory/3240-68-0x0000000010000000-0x000000001025C000-memory.dmp	DanabotLoader2021

Drops file in Windows directory 1 IoCs

Processes:

regsvr32.exe

description ioc process

File opened for modification C:\Windows\win.ini regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3504 wrote to memory of 3240	3504	regsvr32.exe	regsvr32.exe
PID 3504 wrote to memory of 3240	3504	regsvr32.exe	regsvr32.exe
PID 3504 wrote to memory of 3240	3504	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bcefa9f449147383a7af69701c94f5fc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\bcefa9f449147383a7af69701c94f5fc.dll
2⤵
- Drops file in Windows directory
PID:3240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini
Filesize
99B

MD5
dac4d9426cfbe32fe1796feb64cdc6a6

SHA1
75f4b65c3e72eb4ab90d01aa135f848a0bb66d29

SHA256
8490bdaf4269dd3797db4edd82a1b2ece319acbd8fec3936f758d4b6bcde5235

SHA512
36ca07ccf1b3c49fa900631bec0d0c1ff9c94e30c5e9b331ed3ceab88ad5ccc704a95ec1434ac295fdb765f052d70e5aec25a6c32dbc0abeb71a3ab7ae751634

Download Submit
memory/3240-50-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-51-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/3240-52-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-53-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-54-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-55-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-56-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/3240-57-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-58-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-59-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-60-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-61-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-62-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-63-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-64-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-65-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-66-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-67-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download
memory/3240-68-0x0000000010000000-0x000000001025C000-memory.dmp

Filesize
2.4MB

Download