danabot | 8c423458bd656370f8c11a85c21aaec8b1f733dfd320dd7e1f6acca055fceeda

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2024 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91662478862aafbda8fecbaf825a1def.exe
Size

1.2MB
MD5

91662478862aafbda8fecbaf825a1def
SHA1

ad4482f6de0c08e9103810fefa456b9482fd190e
SHA256

8c423458bd656370f8c11a85c21aaec8b1f733dfd320dd7e1f6acca055fceeda
SHA512

a26fd3bd37544e6affe10d8b5b8ddb08a18c872bc8b83aa59616b97ec5b9c0949779d523d567c2187a91564e6f9867a55396e6ba3209c137d4d56890d2a87adc
SSDEEP

24576:mrDanY2ye1cZRzG/BeC2Qw0rQTb99vpMZgpoTv655YkFe/:mz2yj7C/AQw0IPvsYM652kFs

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.206.50:443

142.11.244.124:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 10 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\916624~1.TMP	DanabotLoader2021
behavioral2/memory/2372-10-0x0000000000400000-0x000000000055E000-memory.dmp	DanabotLoader2021
behavioral2/memory/2372-18-0x0000000000400000-0x000000000055E000-memory.dmp	DanabotLoader2021
behavioral2/memory/2372-19-0x0000000000400000-0x000000000055E000-memory.dmp	DanabotLoader2021
behavioral2/memory/2372-20-0x0000000000400000-0x000000000055E000-memory.dmp	DanabotLoader2021
behavioral2/memory/2372-21-0x0000000000400000-0x000000000055E000-memory.dmp	DanabotLoader2021
behavioral2/memory/2372-22-0x0000000000400000-0x000000000055E000-memory.dmp	DanabotLoader2021
behavioral2/memory/2372-23-0x0000000000400000-0x000000000055E000-memory.dmp	DanabotLoader2021
behavioral2/memory/2372-24-0x0000000000400000-0x000000000055E000-memory.dmp	DanabotLoader2021
behavioral2/memory/2372-25-0x0000000000400000-0x000000000055E000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

45 2372 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2372 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1084 3736 WerFault.exe 91662478862aafbda8fecbaf825a1def.exe

flow	pid	process
45	2372	rundll32.exe

pid	process
2372	rundll32.exe

pid	pid_target	process	target process
1084	3736	WerFault.exe	91662478862aafbda8fecbaf825a1def.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

91662478862aafbda8fecbaf825a1def.exe

description	pid	process	target process
PID 3736 wrote to memory of 2372	3736	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe
PID 3736 wrote to memory of 2372	3736	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe
PID 3736 wrote to memory of 2372	3736	91662478862aafbda8fecbaf825a1def.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\91662478862aafbda8fecbaf825a1def.exe
"C:\Users\Admin\AppData\Local\Temp\91662478862aafbda8fecbaf825a1def.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3736

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\916624~1.TMP,S C:\Users\Admin\AppData\Local\Temp\916624~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 444
2⤵
- Program crash
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3736 -ip 3736
1⤵
PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\916624~1.TMP
Filesize
1.3MB

MD5
4aa41aaf04e35d03f880708db1cd5407

SHA1
28594223d6718c61918f0f667cb6a70add3906e4

SHA256
604dce77259862fab9ef6a93b9c0eb1992821967b98d7ab1f0d141593025e16c

SHA512
1bd6a2cb83cdf60db26240bd292124fce39f85cf48c95dab35f43c00010d94ad764bc6becc92a243e0c2048cec3f521c3b8c2b6fe9b86387a8785ab9385e04a6

Download Submit
memory/2372-10-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2372-22-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2372-25-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2372-24-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2372-23-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2372-21-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2372-18-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2372-19-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2372-20-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/3736-1-0x00000000021A0000-0x000000000228C000-memory.dmp

Filesize
944KB

Download
memory/3736-3-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/3736-9-0x0000000002290000-0x0000000002390000-memory.dmp

Filesize
1024KB

Download
memory/3736-8-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/3736-2-0x0000000002290000-0x0000000002390000-memory.dmp

Filesize
1024KB

Download