danabot | 2c5b6da56b0a1822972f1817b41e6fb888790c907f2dfd67c8a64928874ceb2d

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df709113fd89d4d98279d4b7886211c3.exe
Size

1.2MB
MD5

df709113fd89d4d98279d4b7886211c3
SHA1

d1cd48fab61e736406ed04c18d68f170edc1f092
SHA256

2c5b6da56b0a1822972f1817b41e6fb888790c907f2dfd67c8a64928874ceb2d
SHA512

0568870112a2f307f286ca902ac4d40dc5cde7e46214adff1a561276d389c5322aedcdc8d2cb105d8b9e3b0bd412e224847047af718c1d3f33f3808da727198c
SSDEEP

24576:w/5vt2gQxHUWxk2Q0vdEN7s2sW3HOw2qYOP13uQuecphAcXa:w/DQ6ySN7sHw26P13uEydq

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012257-8.dat	DanabotLoader2021
behavioral1/memory/2860-10-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2860-11-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2860-19-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2860-20-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2860-21-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2860-22-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2860-23-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2860-24-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2860-25-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2860-26-0x0000000002150000-0x00000000022AF000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2860	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2860	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2860	2676	df709113fd89d4d98279d4b7886211c3.exe	28
PID 2676 wrote to memory of 2860	2676	df709113fd89d4d98279d4b7886211c3.exe	28
PID 2676 wrote to memory of 2860	2676	df709113fd89d4d98279d4b7886211c3.exe	28
PID 2676 wrote to memory of 2860	2676	df709113fd89d4d98279d4b7886211c3.exe	28
PID 2676 wrote to memory of 2860	2676	df709113fd89d4d98279d4b7886211c3.exe	28
PID 2676 wrote to memory of 2860	2676	df709113fd89d4d98279d4b7886211c3.exe	28
PID 2676 wrote to memory of 2860	2676	df709113fd89d4d98279d4b7886211c3.exe	28

C:\Users\Admin\AppData\Local\Temp\df709113fd89d4d98279d4b7886211c3.exe
"C:\Users\Admin\AppData\Local\Temp\df709113fd89d4d98279d4b7886211c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\DF7091~1.TMP,S C:\Users\Admin\AppData\Local\Temp\DF7091~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DF7091~1.TMP

Filesize
1.3MB

MD5
219e20b69d099cab64444334e0874da8

SHA1
b3ea46e786a2826f4c01c807fee22934aeeb5c7b

SHA256
d50cbc7b8894f96af15f5e150bac2b7e74346dda50e9cd88ede07b56042e35a4

SHA512
063a4105306c1eb8c0a4ab46f0c2788ba1419da0fab62e44520c972b5c1b0ff17b1233e8f61a46c5520d42ae184253ec8b716ae2ba7e2f05f423a2f6233221bb

Download Submit
memory/2676-0-0x0000000001DF0000-0x0000000001EDB000-memory.dmp

Filesize
940KB

Download
memory/2676-2-0x0000000001EE0000-0x0000000001FE0000-memory.dmp

Filesize
1024KB

Download
memory/2676-1-0x0000000001DF0000-0x0000000001EDB000-memory.dmp

Filesize
940KB

Download
memory/2676-3-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2676-6-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2676-7-0x0000000001EE0000-0x0000000001FE0000-memory.dmp

Filesize
1024KB

Download
memory/2860-11-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download
memory/2860-10-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download
memory/2860-19-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download
memory/2860-20-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download
memory/2860-21-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download
memory/2860-22-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download
memory/2860-23-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download
memory/2860-24-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download
memory/2860-25-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download
memory/2860-26-0x0000000002150000-0x00000000022AF000-memory.dmp

Filesize
1.4MB

Download