danabot | 2c5b6da56b0a1822972f1817b41e6fb888790c907f2dfd67c8a64928874ceb2d

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df709113fd89d4d98279d4b7886211c3.exe
Size

1.2MB
MD5

df709113fd89d4d98279d4b7886211c3
SHA1

d1cd48fab61e736406ed04c18d68f170edc1f092
SHA256

2c5b6da56b0a1822972f1817b41e6fb888790c907f2dfd67c8a64928874ceb2d
SHA512

0568870112a2f307f286ca902ac4d40dc5cde7e46214adff1a561276d389c5322aedcdc8d2cb105d8b9e3b0bd412e224847047af718c1d3f33f3808da727198c
SSDEEP

24576:w/5vt2gQxHUWxk2Q0vdEN7s2sW3HOw2qYOP13uQuecphAcXa:w/DQ6ySN7sHw26P13uEydq

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 10 IoCs

resource	yara_rule
behavioral2/files/0x00020000000228bf-6.dat	DanabotLoader2021
behavioral2/memory/1460-10-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1460-18-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1460-19-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1460-20-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1460-21-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1460-22-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1460-23-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1460-24-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1460-25-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
130	1460	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
1460	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4876	5036	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1460	5036	df709113fd89d4d98279d4b7886211c3.exe	91
PID 5036 wrote to memory of 1460	5036	df709113fd89d4d98279d4b7886211c3.exe	91
PID 5036 wrote to memory of 1460	5036	df709113fd89d4d98279d4b7886211c3.exe	91

C:\Users\Admin\AppData\Local\Temp\df709113fd89d4d98279d4b7886211c3.exe
"C:\Users\Admin\AppData\Local\Temp\df709113fd89d4d98279d4b7886211c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\DF7091~1.TMP,S C:\Users\Admin\AppData\Local\Temp\DF7091~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 444
  2⤵
  - Program crash
  PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5036 -ip 5036
1⤵
PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DF7091~1.TMP

Filesize
1.3MB

MD5
219e20b69d099cab64444334e0874da8

SHA1
b3ea46e786a2826f4c01c807fee22934aeeb5c7b

SHA256
d50cbc7b8894f96af15f5e150bac2b7e74346dda50e9cd88ede07b56042e35a4

SHA512
063a4105306c1eb8c0a4ab46f0c2788ba1419da0fab62e44520c972b5c1b0ff17b1233e8f61a46c5520d42ae184253ec8b716ae2ba7e2f05f423a2f6233221bb

Download Submit
memory/1460-10-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1460-22-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1460-25-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1460-24-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1460-23-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1460-21-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1460-18-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1460-19-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1460-20-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/5036-1-0x00000000022D0000-0x00000000023BE000-memory.dmp

Filesize
952KB

Download
memory/5036-3-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/5036-9-0x00000000023C0000-0x00000000024C0000-memory.dmp

Filesize
1024KB

Download
memory/5036-8-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/5036-2-0x00000000023C0000-0x00000000024C0000-memory.dmp

Filesize
1024KB

Download