danabot | 4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d

Analysis

Target
ec7506c2b6460df44c18e61d39d5b1c0.exe
Size 2.6MB
Sample201109-35m4lfb6ds
SHA256 4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d
MD5 ec7506c2b6460df44c18e61d39d5b1c0
SHA1 7c3e46cd7c93f3d9d783888f04f1607f6e487783
SHA512 cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e
MD5 SHA1 SHA512

Score

10^/10

Family

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 5 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

Blocklisted process makes network request 7 IoCs

Loads dropped DLL 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2936	828	ec7506c2b6460df44c18e61d39d5b1c0.exe	78
PID 828 wrote to memory of 2936	828	ec7506c2b6460df44c18e61d39d5b1c0.exe	78
PID 828 wrote to memory of 2936	828	ec7506c2b6460df44c18e61d39d5b1c0.exe	78
PID 2936 wrote to memory of 2040	2936	regsvr32.exe	79
PID 2936 wrote to memory of 2040	2936	regsvr32.exe	79
PID 2936 wrote to memory of 2040	2936	regsvr32.exe	79

C:\Users\Admin\AppData\Local\Temp\ec7506c2b6460df44c18e61d39d5b1c0.exe
"C:\Users\Admin\AppData\Local\Temp\ec7506c2b6460df44c18e61d39d5b1c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\EC7506~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\EC7506~1.EXE@828
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\EC7506~1.DLL,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:2040

memory/828-1-0x00000000035B0000-0x00000000035B1000-memory.dmp

Download