danabot | d876e1d5484e794c97573bb5e21ccd4cbb0d82abb2af83c2e4bb765caad8d43e

Analysis

max time kernel
142s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

751f5e9792c7dc915852167ef26bccb8.exe
Size

1.2MB
MD5

751f5e9792c7dc915852167ef26bccb8
SHA1

309c133c89120b879224273967e1935f93bdd3ad
SHA256

d876e1d5484e794c97573bb5e21ccd4cbb0d82abb2af83c2e4bb765caad8d43e
SHA512

741b56f070d4cccfcb84da0ec5bacc87d43a236a5b565fa54781f5e11eccd5b70aae68002de9538db1ba6b216b750f8a340a0d490f1e6ac5433265a2cb5b37b5
SSDEEP

24576:tkd3TK2y6Rg1Z55FkU3XfUHwdluBdZVKP4D/OPsOpF:tKDy6Rg1BqOUGlWGP4DosOp

Score

10^/10

danabot kinsing 4 banker loader trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 5 IoCs

resource	yara_rule
behavioral2/files/0x000e00000002314e-5.dat	DanabotLoader2021
behavioral2/memory/1572-8-0x0000000001EA0000-0x0000000001FFE000-memory.dmp	DanabotLoader2021
behavioral2/memory/1572-12-0x0000000001EA0000-0x0000000001FFE000-memory.dmp	DanabotLoader2021
behavioral2/memory/1572-20-0x0000000001EA0000-0x0000000001FFE000-memory.dmp	DanabotLoader2021
behavioral2/memory/1572-21-0x0000000001EA0000-0x0000000001FFE000-memory.dmp	DanabotLoader2021

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Blocklisted process makes network request 1 IoCs

flow	pid	Process
43	1572	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
1572	rundll32.exe
1572	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
668	4332	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1572	4332	751f5e9792c7dc915852167ef26bccb8.exe	89
PID 4332 wrote to memory of 1572	4332	751f5e9792c7dc915852167ef26bccb8.exe	89
PID 4332 wrote to memory of 1572	4332	751f5e9792c7dc915852167ef26bccb8.exe	89

C:\Users\Admin\AppData\Local\Temp\751f5e9792c7dc915852167ef26bccb8.exe
"C:\Users\Admin\AppData\Local\Temp\751f5e9792c7dc915852167ef26bccb8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\751F5E~1.TMP,S C:\Users\Admin\AppData\Local\Temp\751F5E~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 520
  2⤵
  - Program crash
  PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4332 -ip 4332
1⤵
PID:4788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\751F5E~1.TMP

Filesize
1.3MB

MD5
1c78e599c4cd81a8d24b261d3bcf4edb

SHA1
5b57d44ca8a87d2f00dd1425854b9dce5b1359ed

SHA256
b07c448bfca39a69d5f715d7a780a6524365040b1ccb048ed643ee3f0ab605ff

SHA512
83a0a69f297c0774da9257e25f19b318b1b66b0769dd6852ad61874bc75bf8058b6ac2478564e6aca891b9ec811ed17186f05eea94083f14fa4c0acc0946d8e2

Download Submit
memory/1572-8-0x0000000001EA0000-0x0000000001FFE000-memory.dmp

Filesize
1.4MB

Download
memory/1572-12-0x0000000001EA0000-0x0000000001FFE000-memory.dmp

Filesize
1.4MB

Download
memory/1572-20-0x0000000001EA0000-0x0000000001FFE000-memory.dmp

Filesize
1.4MB

Download
memory/1572-21-0x0000000001EA0000-0x0000000001FFE000-memory.dmp

Filesize
1.4MB

Download
memory/4332-1-0x0000000004FA0000-0x000000000508E000-memory.dmp

Filesize
952KB

Download
memory/4332-2-0x0000000005090000-0x000000000518F000-memory.dmp

Filesize
1020KB

Download
memory/4332-9-0x0000000000400000-0x0000000003329000-memory.dmp

Filesize
47.2MB

Download
memory/4332-10-0x0000000000400000-0x0000000003329000-memory.dmp

Filesize
47.2MB

Download
memory/4332-11-0x0000000005090000-0x000000000518F000-memory.dmp

Filesize
1020KB

Download