danabot | a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179

General

Target

a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe
Size

1.1MB
MD5

5052b6c32e76ca2c3b5e9226c4bf7466
SHA1

5b9ef788683885cfb12f7f7606a97a0902804eb6
SHA256

a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179
SHA512

5fd76b72a1bbc32fd3fe0287d84e5fa5eeed7b6afc329db250ab076716a8e2dbbcdf588a80e2bf1f5c30f4e9013914a60c9e18791cf8e08629fa256834ccd826
SSDEEP

12288:R70yQ1kTq0Ax8ObckR/IQ2Q50dV42pzUUSm1CrhrSR9sSQxsQZS6lu3ApW9nSkjB:KYTtAxBck7Za5D1Cr9SbsBrS6MBbjyE

Score

10^/10

danabot 5 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

5

C2

103.144.139.105:443

192.236.161.4:443

185.62.58.85:443

23.254.217.192:443

Attributes

embedded_hash
FCEC7AD71028CF938951341A0D9CC1A6
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

3 2252 rundll32.exe
5 2252 rundll32.exe
6 2252 rundll32.exe
7 2252 rundll32.exe
8 2252 rundll32.exe

flow	pid	process
3	2252	rundll32.exe
5	2252	rundll32.exe
6	2252	rundll32.exe
7	2252	rundll32.exe
8	2252	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe

description	pid	process	target process
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 2192 wrote to memory of 2252	2192	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe
"C:\Users\Admin\AppData\Local\Temp\a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\syswow64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
2⤵
- Blocklisted process makes network request
PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000000640000-0x000000000071D000-memory.dmp

Filesize
884KB

Download
memory/2192-1-0x0000000000640000-0x000000000071D000-memory.dmp

Filesize
884KB

Download
memory/2192-4-0x0000000000400000-0x0000000000631000-memory.dmp

Filesize
2.2MB

Download
memory/2192-3-0x0000000000400000-0x0000000000631000-memory.dmp

Filesize
2.2MB

Download
memory/2192-2-0x0000000001FC0000-0x00000000021E5000-memory.dmp

Filesize
2.1MB

Download
memory/2192-5-0x0000000000400000-0x0000000000631000-memory.dmp

Filesize
2.2MB

Download
memory/2192-6-0x00000000772DF000-0x00000000772E0000-memory.dmp

Filesize
4KB

Download
memory/2192-42-0x0000000001FC0000-0x00000000021E5000-memory.dmp

Filesize
2.1MB

Download
memory/2192-41-0x0000000000400000-0x0000000000631000-memory.dmp

Filesize
2.2MB

Download
memory/2192-40-0x0000000000640000-0x000000000071D000-memory.dmp

Filesize
884KB

Download
memory/2252-38-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/2252-44-0x0000000075E50000-0x0000000075F50000-memory.dmp

Filesize
1024KB

Download
memory/2252-36-0x00000000772D0000-0x00000000772D1000-memory.dmp

Filesize
4KB

Download
memory/2252-39-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/2252-35-0x00000000000C0000-0x00000000000C3000-memory.dmp

Filesize
12KB

Download
memory/2252-9-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/2252-7-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/2252-37-0x0000000075E50000-0x0000000075F50000-memory.dmp

Filesize
1024KB

Download
memory/2252-46-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/2252-48-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/2252-50-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/2252-55-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/2252-56-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/2252-59-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/2252-63-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing