danabot | 3f497aa681f8b0a32143720ae18e62adb57dc2a132af18429468e3a1f910e41f

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

274db5e57dce5bf9aa91bc381be76187.dll
Size

2.2MB
MD5

274db5e57dce5bf9aa91bc381be76187
SHA1

c801b02f1bff027e838792179b941367a07b7bb3
SHA256

3f497aa681f8b0a32143720ae18e62adb57dc2a132af18429468e3a1f910e41f
SHA512

2a8ed3670b2516877294cf887266770cd5fd20bdca15ca5f6bad7889d41266ca8d104f1f1447b4acc0ff3666e2aee95334b9a9bde213e17c60aa306715e935ce
SSDEEP

49152:ZAFFPSfj1AHL8ErxKp695mf21wRPehPOaND:ZscRsO21GePOal

Score

10^/10

danabot 11 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

35.182.95.170:443

143.198.45.102:443

134.122.53.241:443

Attributes

embedded_hash
5670762343F3BC936EF5B40A0E878ABD
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 17 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1492-2-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-3-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-4-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-5-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-7-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-8-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-9-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-10-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-11-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-12-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-13-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-14-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-15-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-16-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-17-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-18-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021
behavioral2/memory/1492-19-0x0000000010000000-0x0000000010339000-memory.dmp	DanabotLoader2021

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4988 wrote to memory of 1492	4988	regsvr32.exe	regsvr32.exe
PID 4988 wrote to memory of 1492	4988	regsvr32.exe	regsvr32.exe
PID 4988 wrote to memory of 1492	4988	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\274db5e57dce5bf9aa91bc381be76187.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4988

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\274db5e57dce5bf9aa91bc381be76187.dll
2⤵
PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-0-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-1-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/1492-2-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-3-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-4-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-5-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-6-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/1492-7-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-8-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-9-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-10-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-11-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-12-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-13-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-14-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-15-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-16-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-17-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-18-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download
memory/1492-19-0x0000000010000000-0x0000000010339000-memory.dmp

Filesize
3.2MB

Download