danabot | 504eb3ba676729d316c8f6639ae45b0be030124e0c3007e9edade3b57b49e708

Analysis

Target
SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll
Size 3.3MB
Sample201109-d2rkf4872e
SHA256 504eb3ba676729d316c8f6639ae45b0be030124e0c3007e9edade3b57b49e708
MD5 b5d1fc220f0ad4ae724a50f2a681716d
SHA1 fa6e36d08a36f06c417af13a799cd4570357474c
SHA512 9c34dd5e47b677b390dd41e3823f39f0ce726bb3af4cb75291186bd82634af424b2f3a24223aae3a0a47886cee9fd8386bb4a9aeebbb0f0e9435097549600cab
MD5 SHA1 SHA512

Score

10^/10

Family

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 5 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3284	4856	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4856	4796	rundll32.exe	70
PID 4796 wrote to memory of 4856	4796	rundll32.exe	70
PID 4796 wrote to memory of 4856	4796	rundll32.exe	70
PID 4856 wrote to memory of 4292	4856	rundll32.exe	79
PID 4856 wrote to memory of 4292	4856	rundll32.exe	79
PID 4856 wrote to memory of 4292	4856	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EKTR.2367.dll,f0
    3⤵
    - Blocklisted process makes network request
    PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 744
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3284

memory/3284-2-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/3284-6-0x0000000005750000-0x0000000005751000-memory.dmp

Download