danabot | 44f5331e906dd41bedfa27cda265c62d0afee5a4cc54d18c43bab13367355bb1

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b5b9ab063c20e31fe018e04790a2e0.exe
Size

1.2MB
MD5

80b5b9ab063c20e31fe018e04790a2e0
SHA1

46ef1d41f5fd7c9601250f2c88f3e7444af38314
SHA256

44f5331e906dd41bedfa27cda265c62d0afee5a4cc54d18c43bab13367355bb1
SHA512

2b445956bb55f91093a3942af3c591a203c922cf0e20334968405da8eda1acbcb41d31c3fa91d7579eba6d459e2405b5df53b3a2368d08a56e9a525272ae95df
SSDEEP

24576:V6E5R3KVcpLFO7WB0Ul4ErLvZv3b3l6ylYlR7LmiIA:JR3WclabUl4ErLvZP7sgaBLm

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\80B5B9~1.EXE.tmp	DanabotLoader2021
behavioral2/memory/316-8-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021
behavioral2/memory/316-12-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021
behavioral2/memory/316-20-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021
behavioral2/memory/316-21-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021
behavioral2/memory/316-22-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021
behavioral2/memory/316-23-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021
behavioral2/memory/316-24-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021
behavioral2/memory/316-25-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021
behavioral2/memory/316-26-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021
behavioral2/memory/316-27-0x0000000002170000-0x00000000022CD000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

47 316 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

316 rundll32.exe
316 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4756 2604 WerFault.exe 80b5b9ab063c20e31fe018e04790a2e0.exe

flow	pid	process
47	316	rundll32.exe

pid	process
316	rundll32.exe
316	rundll32.exe

pid	pid_target	process	target process
4756	2604	WerFault.exe	80b5b9ab063c20e31fe018e04790a2e0.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

80b5b9ab063c20e31fe018e04790a2e0.exe

description	pid	process	target process
PID 2604 wrote to memory of 316	2604	80b5b9ab063c20e31fe018e04790a2e0.exe	rundll32.exe
PID 2604 wrote to memory of 316	2604	80b5b9ab063c20e31fe018e04790a2e0.exe	rundll32.exe
PID 2604 wrote to memory of 316	2604	80b5b9ab063c20e31fe018e04790a2e0.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\80b5b9ab063c20e31fe018e04790a2e0.exe
"C:\Users\Admin\AppData\Local\Temp\80b5b9ab063c20e31fe018e04790a2e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\80B5B9~1.TMP,S C:\Users\Admin\AppData\Local\Temp\80B5B9~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 448
2⤵
- Program crash
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2604 -ip 2604
1⤵
PID:4676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80B5B9~1.EXE.tmp

Filesize
1.3MB

MD5
b9a8bd9ca486ff5a2f6a2cb374d597e8

SHA1
b564cc3511ac97752eac4758244f7c25e73cf1ee

SHA256
ac1b8a84c6fa2132007b1f4baa9449b6d468068610b9f6900332ac342221fcbe

SHA512
d3146c825e821feb3a9428f43fc042f0c04cae55db61ccc579005e728b937c16e131013e1eb21c331645a60ec7b93e9a2886fbb3cf0d7f4d40fa4628c157e056

Download Submit
memory/316-24-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/316-23-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/316-8-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/316-27-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/316-26-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/316-25-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/316-20-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/316-21-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/316-12-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/316-22-0x0000000002170000-0x00000000022CD000-memory.dmp

Filesize
1.4MB

Download
memory/2604-2-0x00000000052F0000-0x00000000053EE000-memory.dmp

Filesize
1016KB

Download
memory/2604-1-0x00000000051F0000-0x00000000052E8000-memory.dmp

Filesize
992KB

Download
memory/2604-11-0x00000000052F0000-0x00000000053EE000-memory.dmp

Filesize
1016KB

Download
memory/2604-10-0x0000000000400000-0x00000000033CB000-memory.dmp

Filesize
47.8MB

Download
memory/2604-9-0x0000000000400000-0x00000000033CB000-memory.dmp

Filesize
47.8MB

Download