danabot | 08dcec9e59f25bb87556ea5acb6c778d88f5bf14d4a130758543f85923e646a0

General

Target

a566e990569d33f61fcd5712953e46b7.exe
Size

1.1MB
MD5

a566e990569d33f61fcd5712953e46b7
SHA1

8ec5c1c91ffddd646515e1cf8ae1be49309f5d4b
SHA256

08dcec9e59f25bb87556ea5acb6c778d88f5bf14d4a130758543f85923e646a0
SHA512

3fd93dd14e6d92da6b5f300be484d5da81871ec4c653de66e3a3eab1672b6d79d94da1f90796156d3324942c9d81599e8d538f72be7127a386e310ccf87d8d3d
SSDEEP

24576:DJSnT43vt7dgVL2TE+ZgsPsu1MtxVvt/eXGigJ8YL:kT4fgmEyKu1ml/6KJ8YL

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 13 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\A566E9~1.TMP	DanabotLoader2021
C:\Users\Admin\AppData\Local\Temp\A566E9~1.EXE.tmp	DanabotLoader2021
C:\Users\Admin\AppData\Local\Temp\A566E9~1.EXE.tmp	DanabotLoader2021
behavioral2/memory/572-9-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021
behavioral2/memory/572-12-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021
behavioral2/memory/572-21-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021
behavioral2/memory/572-22-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021
behavioral2/memory/572-23-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021
behavioral2/memory/572-24-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021
behavioral2/memory/572-25-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021
behavioral2/memory/572-26-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021
behavioral2/memory/572-27-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021
behavioral2/memory/572-28-0x0000000002740000-0x000000000289C000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

30 572 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

572 rundll32.exe
572 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1508 2384 WerFault.exe a566e990569d33f61fcd5712953e46b7.exe

flow	pid	process
30	572	rundll32.exe

pid	process
572	rundll32.exe
572	rundll32.exe

pid	pid_target	process	target process
1508	2384	WerFault.exe	a566e990569d33f61fcd5712953e46b7.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a566e990569d33f61fcd5712953e46b7.exe

description	pid	process	target process
PID 2384 wrote to memory of 572	2384	a566e990569d33f61fcd5712953e46b7.exe	rundll32.exe
PID 2384 wrote to memory of 572	2384	a566e990569d33f61fcd5712953e46b7.exe	rundll32.exe
PID 2384 wrote to memory of 572	2384	a566e990569d33f61fcd5712953e46b7.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a566e990569d33f61fcd5712953e46b7.exe
"C:\Users\Admin\AppData\Local\Temp\a566e990569d33f61fcd5712953e46b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\A566E9~1.TMP,S C:\Users\Admin\AppData\Local\Temp\A566E9~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 444
2⤵
- Program crash
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2384 -ip 2384
1⤵
PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A566E9~1.EXE.tmp

Filesize
818KB

MD5
10ddaf4e74ef006a62b03e80303be024

SHA1
1842197bf559710953eb441ab9578f28cf4b6c21

SHA256
e7c9cbc88025f52c8496bd7c9057a7fbf536bf064b0f7f973a5193d55a152093

SHA512
a6638c5cf84267e0318b00a23c5da42ae870f06f1654c61bb4f78bc8e8c222a7f9883308932db56cbdef8d1bdfc51f024d6596844178f3b33e96c62b013a7b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\A566E9~1.EXE.tmp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\A566E9~1.TMP

Filesize
381KB

MD5
13d4aa181d06b8102880c5fa3b0ca91f

SHA1
cd1a94e2b0f259d06268f56dfedc67c7ddac199c

SHA256
70344fa2887833405645001ed806faa1240a40952df6f853ba58c91c47654c37

SHA512
fc9e88a37102d44e344fe38324287569e7c3d35bc56f8d21401add5faa600fa3f0e6d9e6615465eb46e1bc68390bd4693152e13dc759ddf3c29fd1744f0274e5

Download Submit
memory/572-12-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/572-24-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/572-28-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/572-9-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/572-27-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/572-26-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/572-25-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/572-21-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/572-22-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/572-23-0x0000000002740000-0x000000000289C000-memory.dmp

Filesize
1.4MB

Download
memory/2384-3-0x0000000000400000-0x0000000002D4D000-memory.dmp

Filesize
41.3MB

Download
memory/2384-13-0x0000000004C70000-0x0000000004D6E000-memory.dmp

Filesize
1016KB

Download
memory/2384-1-0x0000000004B60000-0x0000000004C52000-memory.dmp

Filesize
968KB

Download
memory/2384-10-0x0000000000400000-0x0000000002D4D000-memory.dmp

Filesize
41.3MB

Download
memory/2384-2-0x0000000004C70000-0x0000000004D6E000-memory.dmp

Filesize
1016KB

Download

Analysis

Sharing