danabot | 7007dec4ec2161c678290c824884e5efad2c665973d275c1c7fb41e08b4a990b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

222_737_81012.vbs
Size

1.4MB
MD5

a2cc4f4bcdae552283245eef031e6a76
SHA1

2c352ebeb6d6d297c897ea4b6a4699aeae305b77
SHA256

94137a6f7898f6f99a2f296690c447c2c3f5faad004cc180f40269dacbced23e
SHA512

6312c0e2b163182b00417d48f291954b39be09fe04570e2c08fe8b00481b24c4815ef8852c8a92ef825e5444fe6511c3b9beeaa9601dfaa0cb238e09cb29ed26
SSDEEP

12288:Negy6Cy/jr3nx6aITPYnAqYmjMaS3QwIdqEXJZRGK5ReKRWFlxEXNUbKCDo/LqPx:Negy49L6btb

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

1.5.78.29

71.61.197.13

128.43.39.106

68.164.114.181

243.7.235.34

185.92.222.238

192.71.249.51

42.180.72.123

159.159.89.172

135.231.151.187

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot x86 payload 1 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
botnet

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq family_danabot
Blocklisted process makes network request 9 IoCs

Processes:

rundll32.exe

flow pid process

18 4532 rundll32.exe
43 4532 rundll32.exe
45 4532 rundll32.exe
48 4532 rundll32.exe
54 4532 rundll32.exe
57 4532 rundll32.exe
58 4532 rundll32.exe
60 4532 rundll32.exe
66 4532 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1688 regsvr32.exe
4532 rundll32.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq	family_danabot

flow	pid	process
18	4532	rundll32.exe
43	4532	rundll32.exe
45	4532	rundll32.exe
48	4532	rundll32.exe
54	4532	rundll32.exe
57	4532	rundll32.exe
58	4532	rundll32.exe
60	4532	rundll32.exe
66	4532	rundll32.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

regsvr32.exerundll32.exe

pid	process
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

WScript.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3372 wrote to memory of 224	3372	WScript.exe	regsvr32.exe
PID 3372 wrote to memory of 224	3372	WScript.exe	regsvr32.exe
PID 224 wrote to memory of 1688	224	regsvr32.exe	regsvr32.exe
PID 224 wrote to memory of 1688	224	regsvr32.exe	regsvr32.exe
PID 224 wrote to memory of 1688	224	regsvr32.exe	regsvr32.exe
PID 1688 wrote to memory of 4532	1688	regsvr32.exe	rundll32.exe
PID 1688 wrote to memory of 4532	1688	regsvr32.exe	rundll32.exe
PID 1688 wrote to memory of 4532	1688	regsvr32.exe	rundll32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\222_737_81012.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3372

C:\Windows\System32\regsvr32.exe
regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq
2⤵
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\SysWOW64\regsvr32.exe
-s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq,f0
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq
Filesize
459KB

MD5
78ad1f6983266579b20b1605dbdc63b4

SHA1
e11f91abb0ad60cc5d781da51339cf196c499da7

SHA256
9a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa

SHA512
3509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097

Download Submit
memory/1688-4-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/4532-7-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4532-9-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4532-17-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download