danabot | 445bd58d9f401c7fb7d977e9b74cc002e5b892ba355f5c00e122cc48b404bac2

Analysis

Target
28ed6bbb727cd4066fb3aa4ec76fd8c0.exe
Size 2.6MB
Sample201109-dd12ckq616
SHA256 445bd58d9f401c7fb7d977e9b74cc002e5b892ba355f5c00e122cc48b404bac2
MD5 28ed6bbb727cd4066fb3aa4ec76fd8c0
SHA1 8a8b036d0a48acb9b685df15e5068de48df705ca
SHA512 f8d1bb33cce2b58267a74a98132a37bf004f28c50b73bf310ac67fde10778420c5c519655968505a852c766a3c21a27af9479fb598d71e7ad9f5bd07fa9568e6
MD5 SHA1 SHA512

Score

10^/10

Family

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

Blocklisted process makes network request 7 IoCs

Loads dropped DLL 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 2736	3980	28ed6bbb727cd4066fb3aa4ec76fd8c0.exe	80
PID 3980 wrote to memory of 2736	3980	28ed6bbb727cd4066fb3aa4ec76fd8c0.exe	80
PID 3980 wrote to memory of 2736	3980	28ed6bbb727cd4066fb3aa4ec76fd8c0.exe	80
PID 2736 wrote to memory of 3184	2736	regsvr32.exe	81
PID 2736 wrote to memory of 3184	2736	regsvr32.exe	81
PID 2736 wrote to memory of 3184	2736	regsvr32.exe	81

C:\Users\Admin\AppData\Local\Temp\28ed6bbb727cd4066fb3aa4ec76fd8c0.exe
"C:\Users\Admin\AppData\Local\Temp\28ed6bbb727cd4066fb3aa4ec76fd8c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\28ED6B~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\28ED6B~1.EXE@3980
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\28ED6B~1.DLL,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:3184

memory/3980-1-0x0000000004700000-0x0000000004701000-memory.dmp

Download