danabot | 3f36f1bc475cbafdcb6c159f4cb42b9ace4a4321c702fc4f21f179a12be48bd3

General

Target

222_737_810161.vbs
Size

1.3MB
MD5

d7100ddc69989fb142f98fff02c6508f
SHA1

29bb5a48a3bb63452b37bf3c2e4acfcae929a975
SHA256

bb0f5392216d97c801dce3d5e18299608bfbaa344063f55a8ef84c40f3002c4f
SHA512

49dee4b048c0515ed1a98adcfab98f1d188da1da2d7cbf8627786e5604e01a0b4500a203a9803e2be81fc7766b4b47870fb9f5fca6ae2a6485a69b94a6613508
SSDEEP

12288:Negy6Cy/jr3nx6aITPYnAqYmjMaS3QwIdqEXJZRGK5ReKRWFlxEXNUbKCDo/LqPP:Negy49L6bEJS

Score

10^/10

danabot banker botnet discovery trojan

Malware Config

Extracted

Family

danabot

C2

1.5.78.29

71.61.197.13

128.43.39.106

68.164.114.181

243.7.235.34

185.92.222.238

192.71.249.51

42.180.72.123

159.159.89.172

135.231.151.187

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x0008000000016fdf-2.dat	family_danabot

Blocklisted process makes network request 9 IoCs

flow	pid	Process
2	2476	rundll32.exe
3	2476	rundll32.exe
6	2476	rundll32.exe
7	2476	rundll32.exe
8	2476	rundll32.exe
9	2476	rundll32.exe
10	2476	rundll32.exe
13	2476	rundll32.exe
16	2476	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
2432	regsvr32.exe
2476	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2432	regsvr32.exe
2432	regsvr32.exe
2432	regsvr32.exe
2432	regsvr32.exe
2432	regsvr32.exe
2432	regsvr32.exe
2432	regsvr32.exe
2432	regsvr32.exe
2476	rundll32.exe
2476	rundll32.exe
2476	rundll32.exe
2476	rundll32.exe
2476	rundll32.exe
2476	rundll32.exe
2476	rundll32.exe
2476	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2328	2596	WScript.exe	30
PID 2596 wrote to memory of 2328	2596	WScript.exe	30
PID 2596 wrote to memory of 2328	2596	WScript.exe	30
PID 2596 wrote to memory of 2328	2596	WScript.exe	30
PID 2596 wrote to memory of 2328	2596	WScript.exe	30
PID 2328 wrote to memory of 2432	2328	regsvr32.exe	31
PID 2328 wrote to memory of 2432	2328	regsvr32.exe	31
PID 2328 wrote to memory of 2432	2328	regsvr32.exe	31
PID 2328 wrote to memory of 2432	2328	regsvr32.exe	31
PID 2328 wrote to memory of 2432	2328	regsvr32.exe	31
PID 2328 wrote to memory of 2432	2328	regsvr32.exe	31
PID 2328 wrote to memory of 2432	2328	regsvr32.exe	31
PID 2432 wrote to memory of 2476	2432	regsvr32.exe	32
PID 2432 wrote to memory of 2476	2432	regsvr32.exe	32
PID 2432 wrote to memory of 2476	2432	regsvr32.exe	32
PID 2432 wrote to memory of 2476	2432	regsvr32.exe	32
PID 2432 wrote to memory of 2476	2432	regsvr32.exe	32
PID 2432 wrote to memory of 2476	2432	regsvr32.exe	32
PID 2432 wrote to memory of 2476	2432	regsvr32.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\222_737_810161.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\System32\regsvr32.exe
  regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\regsvr32.exe
    -s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq

Filesize
459KB

MD5
78ad1f6983266579b20b1605dbdc63b4

SHA1
e11f91abb0ad60cc5d781da51339cf196c499da7

SHA256
9a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa

SHA512
3509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097

Download Submit
memory/2432-4-0x0000000000470000-0x00000000004F0000-memory.dmp

Filesize
512KB

Download
memory/2432-5-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/2476-7-0x0000000000360000-0x00000000003E0000-memory.dmp

Filesize
512KB

Download
memory/2476-8-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2476-9-0x0000000000360000-0x00000000003E0000-memory.dmp

Filesize
512KB

Download
memory/2476-11-0x0000000000360000-0x00000000003E0000-memory.dmp

Filesize
512KB

Download
memory/2476-13-0x0000000000360000-0x00000000003E0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing