danabot | 504eb3ba676729d316c8f6639ae45b0be030124e0c3007e9edade3b57b49e708

Analysis

Target

SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll
Size

3.3MB
MD5

b5d1fc220f0ad4ae724a50f2a681716d
SHA1

fa6e36d08a36f06c417af13a799cd4570357474c
SHA256

504eb3ba676729d316c8f6639ae45b0be030124e0c3007e9edade3b57b49e708
SHA512

9c34dd5e47b677b390dd41e3823f39f0ce726bb3af4cb75291186bd82634af424b2f3a24223aae3a0a47886cee9fd8386bb4a9aeebbb0f0e9435097549600cab

Score

10^/10

Family

danabot

172.81.129.196

54.38.22.65

192.99.219.207

51.255.134.130

192.236.179.73

23.82.140.201

45.147.228.92

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

15 4292 rundll32.exe
16 4292 rundll32.exe
17 4292 rundll32.exe
18 4292 rundll32.exe
19 4292 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3284 4856 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3284	4856	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3284 WerFault.exe
Token: SeBackupPrivilege 3284 WerFault.exe
Token: SeDebugPrivilege 3284 WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4796 wrote to memory of 4856	4796	rundll32.exe	rundll32.exe
PID 4796 wrote to memory of 4856	4796	rundll32.exe	rundll32.exe
PID 4796 wrote to memory of 4856	4796	rundll32.exe	rundll32.exe
PID 4856 wrote to memory of 4292	4856	rundll32.exe	rundll32.exe
PID 4856 wrote to memory of 4292	4856	rundll32.exe	rundll32.exe
PID 4856 wrote to memory of 4292	4856	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll,f0
3⤵
- Blocklisted process makes network request
PID:4292

memory/3284-2-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/3284-6-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/4292-1-0x0000000000000000-mapping.dmp

Download
memory/4856-0-0x0000000000000000-mapping.dmp

Download
memory/4856-4-0x0000000000000000-mapping.dmp

Download
memory/4856-5-0x0000000000000000-mapping.dmp

Download
memory/4856-3-0x0000000000000000-mapping.dmp

Download