danabot | 214e3cd3db2fd521d7a66d0e4ede79c152870ff0330f839d01d7cc141cdc0a14

Analysis

Target

SecuriteInfo.com.Variant.Graftor.752710.8384.15318.dll
Size

3.3MB
MD5

90ac2235ac7890cd0a7c39aedee49302
SHA1

2e6a5a180e757ef69402d20ae21c7dfc5cf96950
SHA256

214e3cd3db2fd521d7a66d0e4ede79c152870ff0330f839d01d7cc141cdc0a14
SHA512

349d7cb55bfc05815d5949d8009c45e7fdd9665649b67ecd4a7162a2fa153fc09ca3ad17b3617b8c1df3a677c713ee6e701067a5fc2a8b5257b8678d88be96c7

Score

10^/10

Family

danabot

172.81.129.196

54.38.22.65

192.99.219.207

51.255.134.130

192.236.179.73

23.82.140.201

45.147.228.92

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

16 2692 rundll32.exe
17 2692 rundll32.exe
18 2692 rundll32.exe
19 2692 rundll32.exe
20 2692 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1872 360 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1872	360	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1872 WerFault.exe
Token: SeBackupPrivilege 1872 WerFault.exe
Token: SeDebugPrivilege 1872 WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 412 wrote to memory of 360	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 360	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 360	412	rundll32.exe	rundll32.exe
PID 360 wrote to memory of 2692	360	rundll32.exe	rundll32.exe
PID 360 wrote to memory of 2692	360	rundll32.exe	rundll32.exe
PID 360 wrote to memory of 2692	360	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.752710.8384.15318.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.752710.8384.15318.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:360

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.752710.8384.15318.dll,f0
3⤵
- Blocklisted process makes network request
PID:2692

memory/360-0-0x0000000000000000-mapping.dmp

Download
memory/360-5-0x0000000000000000-mapping.dmp

Download
memory/360-7-0x0000000000000000-mapping.dmp

Download
memory/360-6-0x0000000000000000-mapping.dmp

Download
memory/1872-2-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/1872-3-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/1872-9-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download
memory/2692-1-0x0000000000000000-mapping.dmp

Download