danabot | 8c423458bd656370f8c11a85c21aaec8b1f733dfd320dd7e1f6acca055fceeda

General

Target

91662478862aafbda8fecbaf825a1def.exe
Size

1.2MB
MD5

91662478862aafbda8fecbaf825a1def
SHA1

ad4482f6de0c08e9103810fefa456b9482fd190e
SHA256

8c423458bd656370f8c11a85c21aaec8b1f733dfd320dd7e1f6acca055fceeda
SHA512

a26fd3bd37544e6affe10d8b5b8ddb08a18c872bc8b83aa59616b97ec5b9c0949779d523d567c2187a91564e6f9867a55396e6ba3209c137d4d56890d2a87adc
SSDEEP

24576:mrDanY2ye1cZRzG/BeC2Qw0rQTb99vpMZgpoTv655YkFe/:mz2yj7C/AQw0IPvsYM652kFs

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.206.50:443

142.11.244.124:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\916624~1.TMP	DanabotLoader2021
behavioral1/memory/2364-11-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2364-12-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2364-20-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2364-21-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2364-22-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2364-23-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2364-24-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2364-25-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2364-26-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2364-27-0x0000000001D00000-0x0000000001E5E000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2364 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2364 rundll32.exe

flow	pid	process
2	2364	rundll32.exe

pid	process
2364	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

91662478862aafbda8fecbaf825a1def.exe

description	pid	process	target process
PID 2676 wrote to memory of 2364	2676	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe
PID 2676 wrote to memory of 2364	2676	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe
PID 2676 wrote to memory of 2364	2676	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe
PID 2676 wrote to memory of 2364	2676	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe
PID 2676 wrote to memory of 2364	2676	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe
PID 2676 wrote to memory of 2364	2676	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe
PID 2676 wrote to memory of 2364	2676	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\91662478862aafbda8fecbaf825a1def.exe
"C:\Users\Admin\AppData\Local\Temp\91662478862aafbda8fecbaf825a1def.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\916624~1.TMP,S C:\Users\Admin\AppData\Local\Temp\916624~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\916624~1.TMP

Filesize
1.3MB

MD5
4aa41aaf04e35d03f880708db1cd5407

SHA1
28594223d6718c61918f0f667cb6a70add3906e4

SHA256
604dce77259862fab9ef6a93b9c0eb1992821967b98d7ab1f0d141593025e16c

SHA512
1bd6a2cb83cdf60db26240bd292124fce39f85cf48c95dab35f43c00010d94ad764bc6becc92a243e0c2048cec3f521c3b8c2b6fe9b86387a8785ab9385e04a6

Download Submit
memory/2364-22-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-11-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-12-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-27-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-20-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-26-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-25-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-21-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-24-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2364-23-0x0000000001D00000-0x0000000001E5E000-memory.dmp

Filesize
1.4MB

Download
memory/2676-8-0x0000000000550000-0x000000000063A000-memory.dmp

Filesize
936KB

Download
memory/2676-0-0x0000000000550000-0x000000000063A000-memory.dmp

Filesize
936KB

Download
memory/2676-1-0x0000000000550000-0x000000000063A000-memory.dmp

Filesize
936KB

Download
memory/2676-3-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2676-9-0x0000000001EA0000-0x0000000001FA0000-memory.dmp

Filesize
1024KB

Download
memory/2676-2-0x0000000001EA0000-0x0000000001FA0000-memory.dmp

Filesize
1024KB

Download
memory/2676-6-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing