danabot | fd3cc7e17526fcbb103dc01f2faca1b6acea3be78916781242d679e730cb4a9e

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2025, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66b7a497ff759634f91c4a6ae7c0b6fd90cd0c61076e4abc8d2f9166f343805a.js
Size

1.4MB
MD5

58a4f4d720e37e8068e6ebf835f5e37c
SHA1

81b196c4175097a2bc639764e71454986060da66
SHA256

66b7a497ff759634f91c4a6ae7c0b6fd90cd0c61076e4abc8d2f9166f343805a
SHA512

737932aa10d7bdef164441348b21c9b041476ce111ef9ad820c666b03a949589c12baa8fe07ef6db9c0487f8300e765604b27f16abecc04a0a2bb847ca1cc7f6
SSDEEP

1536:IEhnxw356jtCqQa+m/qCHPxGZvc8p8KoR0B2OncUhUtO91HnjCimnRZete7PENLR:I5xsWqsW+WLdeiot/lzwDA

Score

10^/10

danabot banker botnet discovery execution trojan

Malware Config

Extracted

Family

danabot

209.182.218.222

185.227.109.40

185.136.165.128

161.129.65.197

217.182.56.71

254.55.37.53

228.175.167.154

56.38.135.17

168.127.65.186

185.181.8.49

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral2/files/0x000b000000024150-1.dat	family_danabot

Blocklisted process makes network request 8 IoCs

flow	pid	Process
17	1708	rundll32.exe
25	1708	rundll32.exe
31	1708	rundll32.exe
57	1708	rundll32.exe
58	1708	rundll32.exe
66	1708	rundll32.exe
67	1708	rundll32.exe
70	1708	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 4 IoCs

pid	Process
3992	regsvr32.exe
3992	regsvr32.exe
1708	rundll32.exe
1708	rundll32.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 5736	4940	wscript.exe	88
PID 4940 wrote to memory of 5736	4940	wscript.exe	88
PID 5736 wrote to memory of 3992	5736	regsvr32.exe	89
PID 5736 wrote to memory of 3992	5736	regsvr32.exe	89
PID 5736 wrote to memory of 3992	5736	regsvr32.exe	89
PID 3992 wrote to memory of 1708	3992	regsvr32.exe	90
PID 3992 wrote to memory of 1708	3992	regsvr32.exe	90
PID 3992 wrote to memory of 1708	3992	regsvr32.exe	90

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\66b7a497ff759634f91c4a6ae7c0b6fd90cd0c61076e4abc8d2f9166f343805a.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\lEDVIkQSVYhQAzRgNIlEfQ.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\SysWOW64\regsvr32.exe
    -s C:\Users\Admin\AppData\Local\Temp\\lEDVIkQSVYhQAzRgNIlEfQ.dll
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\lEDVIkQSVYhQAzRgNIlEfQ.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lEDVIkQSVYhQAzRgNIlEfQ.dll

Filesize
355KB

MD5
edb09790e89ee476cfb7e66a1f7cad7b

SHA1
f25e69a0447936ec278808bdfb942a4e7125c46c

SHA256
0578160ca0061e8b9b0e61ecb6b057babdeff7580d5a58e0724e7bb4e7e51d93

SHA512
ebd154521917fb876736dcb62ce35517dcf5ccf513a8903544f681ac2d1adacff894dfe3615a1f005e65b8cb738ac47ab83ac85eaa16bfd897a1868e3d16aecb

Download Submit
memory/1708-7-0x0000000000AA0000-0x0000000000B05000-memory.dmp

Filesize
404KB

Download
memory/1708-8-0x0000000000AA0000-0x0000000000B05000-memory.dmp

Filesize
404KB

Download
memory/3992-4-0x0000000000510000-0x0000000000575000-memory.dmp

Filesize
404KB

Download