danabot | a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179

General

Target

a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe
Size

1.1MB
MD5

5052b6c32e76ca2c3b5e9226c4bf7466
SHA1

5b9ef788683885cfb12f7f7606a97a0902804eb6
SHA256

a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179
SHA512

5fd76b72a1bbc32fd3fe0287d84e5fa5eeed7b6afc329db250ab076716a8e2dbbcdf588a80e2bf1f5c30f4e9013914a60c9e18791cf8e08629fa256834ccd826
SSDEEP

12288:R70yQ1kTq0Ax8ObckR/IQ2Q50dV42pzUUSm1CrhrSR9sSQxsQZS6lu3ApW9nSkjB:KYTtAxBck7Za5D1Cr9SbsBrS6MBbjyE

Score

10^/10

danabot 5 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

5

C2

103.144.139.105:443

192.236.161.4:443

185.62.58.85:443

23.254.217.192:443

Attributes

embedded_hash
FCEC7AD71028CF938951341A0D9CC1A6
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

22 1980 rundll32.exe
24 1980 rundll32.exe
26 1980 rundll32.exe
31 1980 rundll32.exe
35 1980 rundll32.exe
37 1980 rundll32.exe
38 1980 rundll32.exe

flow	pid	process
22	1980	rundll32.exe
24	1980	rundll32.exe
26	1980	rundll32.exe
31	1980	rundll32.exe
35	1980	rundll32.exe
37	1980	rundll32.exe
38	1980	rundll32.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe

description	pid	process	target process
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe
PID 1648 wrote to memory of 1980	1648	a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe
"C:\Users\Admin\AppData\Local\Temp\a7d32bdbb4d6f252707a1a16e14148a51959bc6bc68a2719742337f8a52ff179.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
2⤵
- Blocklisted process makes network request
PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-15-0x0000000002390000-0x0000000002470000-memory.dmp

Filesize
896KB

Download
memory/1648-2-0x00000000025B0000-0x00000000027D5000-memory.dmp

Filesize
2.1MB

Download
memory/1648-3-0x0000000000400000-0x0000000000631000-memory.dmp

Filesize
2.2MB

Download
memory/1648-4-0x0000000000400000-0x0000000000631000-memory.dmp

Filesize
2.2MB

Download
memory/1648-5-0x0000000000400000-0x0000000000631000-memory.dmp

Filesize
2.2MB

Download
memory/1648-6-0x0000000076F22000-0x0000000076F23000-memory.dmp

Filesize
4KB

Download
memory/1648-18-0x0000000076F22000-0x0000000076F23000-memory.dmp

Filesize
4KB

Download
memory/1648-1-0x0000000002390000-0x0000000002470000-memory.dmp

Filesize
896KB

Download
memory/1648-17-0x00000000025B0000-0x00000000027D5000-memory.dmp

Filesize
2.1MB

Download
memory/1648-16-0x0000000000400000-0x0000000000631000-memory.dmp

Filesize
2.2MB

Download
memory/1980-7-0x00000000010A0000-0x00000000010A3000-memory.dmp

Filesize
12KB

Download
memory/1980-22-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-13-0x00000000010D0000-0x00000000010D3000-memory.dmp

Filesize
12KB

Download
memory/1980-14-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-12-0x00000000010C0000-0x00000000010C3000-memory.dmp

Filesize
12KB

Download
memory/1980-10-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-9-0x0000000076D00000-0x0000000076EA0000-memory.dmp

Filesize
1.6MB

Download
memory/1980-8-0x0000000076F24000-0x0000000076F25000-memory.dmp

Filesize
4KB

Download
memory/1980-21-0x0000000076D00000-0x0000000076EA0000-memory.dmp

Filesize
1.6MB

Download
memory/1980-11-0x00000000010B0000-0x00000000010B3000-memory.dmp

Filesize
12KB

Download
memory/1980-25-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-26-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-29-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-30-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-33-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-34-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-38-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-39-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-42-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/1980-43-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing