danabot | 2dcd85215e085d1ed46a1f8840605bd49264096dbbd0e840c12607a8c0aacfa0

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac6cf4bd1a554f44a2ce5542b30e6cc3.exe
Size 1.1MB
Sample240228-vtpvashf25
SHA256 2dcd85215e085d1ed46a1f8840605bd49264096dbbd0e840c12607a8c0aacfa0
MD5 ac6cf4bd1a554f44a2ce5542b30e6cc3
SHA1 cdaaf79fc8cd25d4ae000ffe6f7a7d0c7324710c
SHA512 5d4e2ca9a7172d95d929cee8abc4915092ef2681a4549a5cc5e91d14f1387b2a08744622fb8e8dfc9d795d5fd6c5c53190b687d7e5afdef18aa05cddbd9a60b6
SSDEEP 24576:uF/GzdqS2G86ayfIR9V6P+r8QHuHHanLwE/7U0+9jrD90IYO:UGxqS2B6aWU98WrIH4UE/7Ufd3YO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

193.34.167.138:443
152.89.247.31:443
192.210.222.81:443
142.11.244.124:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 7 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023273-7.dat	DanabotLoader2021
behavioral2/files/0x0008000000023273-9.dat	DanabotLoader2021
behavioral2/memory/1092-10-0x0000000002D40000-0x0000000002E9D000-memory.dmp	DanabotLoader2021
behavioral2/files/0x0008000000023273-8.dat	DanabotLoader2021
behavioral2/memory/1092-13-0x0000000002D40000-0x0000000002E9D000-memory.dmp	DanabotLoader2021
behavioral2/memory/1092-21-0x0000000002D40000-0x0000000002E9D000-memory.dmp	DanabotLoader2021
behavioral2/memory/1092-22-0x0000000002D40000-0x0000000002E9D000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
65	1092	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
1092	rundll32.exe
1092	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1456	4204	WerFault.exe	38

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 1092	4204	ac6cf4bd1a554f44a2ce5542b30e6cc3.exe	98
PID 4204 wrote to memory of 1092	4204	ac6cf4bd1a554f44a2ce5542b30e6cc3.exe	98
PID 4204 wrote to memory of 1092	4204	ac6cf4bd1a554f44a2ce5542b30e6cc3.exe	98

C:\Users\Admin\AppData\Local\Temp\ac6cf4bd1a554f44a2ce5542b30e6cc3.exe
"C:\Users\Admin\AppData\Local\Temp\ac6cf4bd1a554f44a2ce5542b30e6cc3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\AC6CF4~1.TMP,S C:\Users\Admin\AppData\Local\Temp\AC6CF4~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 536
  2⤵
  - Program crash
  PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4204 -ip 4204
1⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AC6CF4~1.EXE.tmp

Path C:\Users\Admin\AppData\Local\Temp\AC6CF4~1.EXE.tmp
Size 1.0MB
SHA256 e91658de04c299791e4e9cbd8df7c0921f3326fe316b995d4b95490844ebf592
MD5 8657e678ca8aa99216011cc659b22396
SHA1 ff80585106a1551668d70788bdc6409f04ae5d5a
SHA512 d61389a38f233841ecce0fce9e3b3a7b662cb5b68c17837f8f2a9ae22bdcd7ded90d09ae09b0a98c9fe3ad87b900bbf8f827136263ccc9e4ec537f23c4276ad9
SSDEEP 12288:QccFyQh5cKdUNpV86DDQnf25xs9LoAy9pNKUGVXI7G:TcFXBGNpvDy25xyLoAynNKUGVXI7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

AC6CF4~1.EXE.tmp

Path C:\Users\Admin\AppData\Local\Temp\AC6CF4~1.EXE.tmp
Size 996KB
SHA256 daba17d1989c0d70a6b04d20d1c68ec221bfec4b7702e85a2f66762239759958
MD5 94d9ac397a6e52d36275a5fa5a1e4e97
SHA1 8a3f91740cb2a056edb70df4c2ff94eea3dfe832
SHA512 cbd7a068f823abdd6f34c5027f4e9316d0db5a3803e7cf37be961127f894eb1c4b4a001159044254f1ab6306cc9cd6fbb136ffd4506cb833114ceef370c97887
SSDEEP 12288:QccFyQh5cKdUNpV86DDQnf25xs9LoAy9pNKUGVXI1:TcFXBGNpvDy25xyLoAynNKUGVXI1
MD5 SHA1 SHA512 SSDEEP

Submit Download

AC6CF4~1.TMP

Path C:\Users\Admin\AppData\Local\Temp\AC6CF4~1.TMP
Size 854KB
SHA256 19b11c782e6510a60f893f4241758e24ab9d3bb68ea3021a0a58a05b526a7b66
MD5 7eb0e44a11e9072950fd0157f642b470
SHA1 29ea70e89faad52aab55edcd1d4b9246ec61098a
SHA512 3939320c65192fdcac2d40f343eeaea368d581052213f6b2edb3409a08b1d78866dd6ff9a63592bedeea437ecb93df3d2ec0ba230c37bc1cd8cab73add104df1
SSDEEP 12288:QccFyQh5cKdUNpV86DDQnf25xs9LoAy9pN8:TcFXBGNpvDy25xyLoAynN8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1092-10-0x0000000002D40000-0x0000000002E9D000-memory.dmp

Download

memory/1092-13-0x0000000002D40000-0x0000000002E9D000-memory.dmp

Download

memory/1092-21-0x0000000002D40000-0x0000000002E9D000-memory.dmp

Download

memory/1092-22-0x0000000002D40000-0x0000000002E9D000-memory.dmp

Download

memory/4204-1-0x0000000004AE0000-0x0000000004BD6000-memory.dmp

Download

memory/4204-2-0x0000000004C90000-0x0000000004D8E000-memory.dmp

Download

memory/4204-3-0x0000000000400000-0x0000000002D9A000-memory.dmp

Download

memory/4204-6-0x0000000000400000-0x0000000002D9A000-memory.dmp

Download

memory/4204-12-0x0000000004C90000-0x0000000004D8E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads