danabot | fd3cc7e17526fcbb103dc01f2faca1b6acea3be78916781242d679e730cb4a9e

General

Target

66b7a497ff759634f91c4a6ae7c0b6fd90cd0c61076e4abc8d2f9166f343805a.js
Size

1.4MB
MD5

58a4f4d720e37e8068e6ebf835f5e37c
SHA1

81b196c4175097a2bc639764e71454986060da66
SHA256

66b7a497ff759634f91c4a6ae7c0b6fd90cd0c61076e4abc8d2f9166f343805a
SHA512

737932aa10d7bdef164441348b21c9b041476ce111ef9ad820c666b03a949589c12baa8fe07ef6db9c0487f8300e765604b27f16abecc04a0a2bb847ca1cc7f6
SSDEEP

1536:IEhnxw356jtCqQa+m/qCHPxGZvc8p8KoR0B2OncUhUtO91HnjCimnRZete7PENLR:I5xsWqsW+WLdeiot/lzwDA

Score

10^/10

danabot banker botnet discovery execution trojan

Malware Config

Extracted

Family

danabot

C2

209.182.218.222

185.227.109.40

185.136.165.128

161.129.65.197

217.182.56.71

254.55.37.53

228.175.167.154

56.38.135.17

168.127.65.186

185.181.8.49

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x00060000000186c6-1.dat	family_danabot

Blocklisted process makes network request 8 IoCs

flow	pid	Process
2	2536	rundll32.exe
3	2536	rundll32.exe
6	2536	rundll32.exe
9	2536	rundll32.exe
10	2536	rundll32.exe
11	2536	rundll32.exe
14	2536	rundll32.exe
15	2536	rundll32.exe

Loads dropped DLL 5 IoCs

pid	Process
2808	regsvr32.exe
2536	rundll32.exe
2536	rundll32.exe
2536	rundll32.exe
2536	rundll32.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2680	2668	wscript.exe	30
PID 2668 wrote to memory of 2680	2668	wscript.exe	30
PID 2668 wrote to memory of 2680	2668	wscript.exe	30
PID 2668 wrote to memory of 2680	2668	wscript.exe	30
PID 2668 wrote to memory of 2680	2668	wscript.exe	30
PID 2680 wrote to memory of 2808	2680	regsvr32.exe	31
PID 2680 wrote to memory of 2808	2680	regsvr32.exe	31
PID 2680 wrote to memory of 2808	2680	regsvr32.exe	31
PID 2680 wrote to memory of 2808	2680	regsvr32.exe	31
PID 2680 wrote to memory of 2808	2680	regsvr32.exe	31
PID 2680 wrote to memory of 2808	2680	regsvr32.exe	31
PID 2680 wrote to memory of 2808	2680	regsvr32.exe	31
PID 2808 wrote to memory of 2536	2808	regsvr32.exe	32
PID 2808 wrote to memory of 2536	2808	regsvr32.exe	32
PID 2808 wrote to memory of 2536	2808	regsvr32.exe	32
PID 2808 wrote to memory of 2536	2808	regsvr32.exe	32
PID 2808 wrote to memory of 2536	2808	regsvr32.exe	32
PID 2808 wrote to memory of 2536	2808	regsvr32.exe	32
PID 2808 wrote to memory of 2536	2808	regsvr32.exe	32

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\66b7a497ff759634f91c4a6ae7c0b6fd90cd0c61076e4abc8d2f9166f343805a.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\lEDVIkQSVYhQAzRgNIlEfQ.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\regsvr32.exe
    -s C:\Users\Admin\AppData\Local\Temp\\lEDVIkQSVYhQAzRgNIlEfQ.dll
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\lEDVIkQSVYhQAzRgNIlEfQ.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lEDVIkQSVYhQAzRgNIlEfQ.dll

Filesize
355KB

MD5
edb09790e89ee476cfb7e66a1f7cad7b

SHA1
f25e69a0447936ec278808bdfb942a4e7125c46c

SHA256
0578160ca0061e8b9b0e61ecb6b057babdeff7580d5a58e0724e7bb4e7e51d93

SHA512
ebd154521917fb876736dcb62ce35517dcf5ccf513a8903544f681ac2d1adacff894dfe3615a1f005e65b8cb738ac47ab83ac85eaa16bfd897a1868e3d16aecb

Download Submit
memory/2536-8-0x0000000000210000-0x0000000000275000-memory.dmp

Filesize
404KB

Download
memory/2536-9-0x0000000000210000-0x0000000000275000-memory.dmp

Filesize
404KB

Download
memory/2808-3-0x0000000000670000-0x00000000006D5000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing