danabot | 02a931bd8d90478e89631fca772c3592ed2f12bb50baf4c5f989e512b80961f5

General

Target

9a505d2be9d9d8efa97018f0bebe5660.exe
Size

1.2MB
MD5

9a505d2be9d9d8efa97018f0bebe5660
SHA1

549be56cb07367345b5d1a8c24cf12a3117e9bb0
SHA256

02a931bd8d90478e89631fca772c3592ed2f12bb50baf4c5f989e512b80961f5
SHA512

8bf807daad544ad63d5739243765d18e49fe04704fba9f6a82a200bde65899db0e3854cae8efdfac015824fac514f48567138b1cfb7c973c56386c3169994eeb
SSDEEP

24576:SHtd+xuw3WhBvcCTVaYIEkcFiLOYeDZazGmvaNRzH2e:M63KBECBBgOYwZHgCRzH

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\9A505D~1.TMP	DanabotLoader2021
behavioral1/memory/1116-10-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021
behavioral1/memory/1116-12-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021
behavioral1/memory/1116-20-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021
behavioral1/memory/1116-21-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021
behavioral1/memory/1116-22-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021
behavioral1/memory/1116-23-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021
behavioral1/memory/1116-24-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021
behavioral1/memory/1116-25-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021
behavioral1/memory/1116-26-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021
behavioral1/memory/1116-27-0x00000000008B0000-0x0000000000A0E000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1116 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1116 rundll32.exe

flow	pid	process
2	1116	rundll32.exe

pid	process
1116	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

9a505d2be9d9d8efa97018f0bebe5660.exe

description	pid	process	target process
PID 3060 wrote to memory of 1116	3060	9a505d2be9d9d8efa97018f0bebe5660.exe	rundll32.exe
PID 3060 wrote to memory of 1116	3060	9a505d2be9d9d8efa97018f0bebe5660.exe	rundll32.exe
PID 3060 wrote to memory of 1116	3060	9a505d2be9d9d8efa97018f0bebe5660.exe	rundll32.exe
PID 3060 wrote to memory of 1116	3060	9a505d2be9d9d8efa97018f0bebe5660.exe	rundll32.exe
PID 3060 wrote to memory of 1116	3060	9a505d2be9d9d8efa97018f0bebe5660.exe	rundll32.exe
PID 3060 wrote to memory of 1116	3060	9a505d2be9d9d8efa97018f0bebe5660.exe	rundll32.exe
PID 3060 wrote to memory of 1116	3060	9a505d2be9d9d8efa97018f0bebe5660.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\9a505d2be9d9d8efa97018f0bebe5660.exe
"C:\Users\Admin\AppData\Local\Temp\9a505d2be9d9d8efa97018f0bebe5660.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9A505D~1.TMP,S C:\Users\Admin\AppData\Local\Temp\9A505D~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9A505D~1.TMP
Filesize
1.3MB

MD5
a6137d893986217a855f251b76cae484

SHA1
e7075f03b863cfb5c76eb9ad0d0161ea7889fc98

SHA256
1fa280b8c7348e215595f000e4d97a49813cb4c0dd030837ac637ad60923942b

SHA512
3eadb85b54daf130ab94de642cd60f60ed09ada178a4f2d08b77012b0219d0ec484d229322744090b1921d668b22c4b0f5d4cda4d81337b03e132187e809cd49

Download Submit
memory/1116-21-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-27-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-26-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-25-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-24-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-23-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-10-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-22-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-12-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-20-0x00000000008B0000-0x0000000000A0E000-memory.dmp

Filesize
1.4MB

Download
memory/3060-6-0x0000000000400000-0x00000000009E2000-memory.dmp

Filesize
5.9MB

Download
memory/3060-11-0x00000000009F0000-0x0000000000ADA000-memory.dmp

Filesize
936KB

Download
memory/3060-7-0x0000000000BE0000-0x0000000000CE0000-memory.dmp

Filesize
1024KB

Download
memory/3060-0-0x00000000009F0000-0x0000000000ADA000-memory.dmp

Filesize
936KB

Download
memory/3060-5-0x0000000000400000-0x00000000009E2000-memory.dmp

Filesize
5.9MB

Download
memory/3060-2-0x0000000000BE0000-0x0000000000CE0000-memory.dmp

Filesize
1024KB

Download
memory/3060-1-0x00000000009F0000-0x0000000000ADA000-memory.dmp

Filesize
936KB

Download

Analysis

Sharing