danabot | f8c983fce1af5b6e17289a88d19a70fb5a67c6bc32d7aa4f3bc3ce1ffcddc282

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-02-2024 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a40b8f61420b24835c93f7974f39a23e.exe
Size

1.2MB
MD5

a40b8f61420b24835c93f7974f39a23e
SHA1

bce1227b915b76825b3589c3b60ccc2e114f7dd2
SHA256

f8c983fce1af5b6e17289a88d19a70fb5a67c6bc32d7aa4f3bc3ce1ffcddc282
SHA512

75b81661d3758b207b1f2dfc8d5dd40bd868934b931f0c0513e5d1f95ba665b7949b8db8528351d55b18f443a644094f57d07c85317510961b5f5a9a1353f95a
SSDEEP

24576:7xBaQMsE+VUxLY8VKUgln+NNTbhbY1oY2vTCtKz7HD53J:7N7yK5a6YTSe7V3J

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.206.50:443

142.11.244.124:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\A40B8F~1.TMP	DanabotLoader2021
behavioral1/memory/2796-9-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021
behavioral1/memory/2796-11-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021
behavioral1/memory/2796-19-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021
behavioral1/memory/2796-20-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021
behavioral1/memory/2796-21-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021
behavioral1/memory/2796-22-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021
behavioral1/memory/2796-23-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021
behavioral1/memory/2796-24-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021
behavioral1/memory/2796-25-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021
behavioral1/memory/2796-26-0x0000000001E70000-0x0000000001FCE000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2796 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2796 rundll32.exe

flow	pid	process
2	2796	rundll32.exe

pid	process
2796	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

a40b8f61420b24835c93f7974f39a23e.exe

description	pid	process	target process
PID 2912 wrote to memory of 2796	2912	a40b8f61420b24835c93f7974f39a23e.exe	rundll32.exe
PID 2912 wrote to memory of 2796	2912	a40b8f61420b24835c93f7974f39a23e.exe	rundll32.exe
PID 2912 wrote to memory of 2796	2912	a40b8f61420b24835c93f7974f39a23e.exe	rundll32.exe
PID 2912 wrote to memory of 2796	2912	a40b8f61420b24835c93f7974f39a23e.exe	rundll32.exe
PID 2912 wrote to memory of 2796	2912	a40b8f61420b24835c93f7974f39a23e.exe	rundll32.exe
PID 2912 wrote to memory of 2796	2912	a40b8f61420b24835c93f7974f39a23e.exe	rundll32.exe
PID 2912 wrote to memory of 2796	2912	a40b8f61420b24835c93f7974f39a23e.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a40b8f61420b24835c93f7974f39a23e.exe
"C:\Users\Admin\AppData\Local\Temp\a40b8f61420b24835c93f7974f39a23e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\A40B8F~1.TMP,S C:\Users\Admin\AppData\Local\Temp\A40B8F~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A40B8F~1.TMP
Filesize
1.3MB

MD5
4aa41aaf04e35d03f880708db1cd5407

SHA1
28594223d6718c61918f0f667cb6a70add3906e4

SHA256
604dce77259862fab9ef6a93b9c0eb1992821967b98d7ab1f0d141593025e16c

SHA512
1bd6a2cb83cdf60db26240bd292124fce39f85cf48c95dab35f43c00010d94ad764bc6becc92a243e0c2048cec3f521c3b8c2b6fe9b86387a8785ab9385e04a6

Download Submit
memory/2796-22-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2796-9-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2796-26-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2796-25-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2796-19-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2796-24-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2796-23-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2796-11-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2796-21-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2796-20-0x0000000001E70000-0x0000000001FCE000-memory.dmp

Filesize
1.4MB

Download
memory/2912-2-0x0000000001F10000-0x0000000002010000-memory.dmp

Filesize
1024KB

Download
memory/2912-0-0x0000000000550000-0x000000000063A000-memory.dmp

Filesize
936KB

Download
memory/2912-1-0x0000000000550000-0x000000000063A000-memory.dmp

Filesize
936KB

Download
memory/2912-10-0x0000000001F10000-0x0000000002010000-memory.dmp

Filesize
1024KB

Download
memory/2912-6-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/2912-3-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download