danabot | 677f90dd4838bff9c07d1f730907777ce27bdf40cca7a7a664cf675cf33b4622

Analysis

Target
dc825fb0f3c7fb28693590a4a5c1cc7f.exe
Size 2.7MB
Sample201109-nbveavcmm6
SHA256 677f90dd4838bff9c07d1f730907777ce27bdf40cca7a7a664cf675cf33b4622
MD5 dc825fb0f3c7fb28693590a4a5c1cc7f
SHA1 6d1a2bf886509558c876c82e94465ce0b1fa0b4d
SHA512 4926dcd73f5e52f2b5ba4c05ecd5610e57feea41f3367d724d0ec87bc0acd6546066f33b117921b27f5c48b2257794e117a19ffbbb5969834c95f1cab29224b5
MD5 SHA1 SHA512

Score

10^/10

Family

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

Blocklisted process makes network request 8 IoCs

Loads dropped DLL 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 3308	508	dc825fb0f3c7fb28693590a4a5c1cc7f.exe	78
PID 508 wrote to memory of 3308	508	dc825fb0f3c7fb28693590a4a5c1cc7f.exe	78
PID 508 wrote to memory of 3308	508	dc825fb0f3c7fb28693590a4a5c1cc7f.exe	78
PID 3308 wrote to memory of 2832	3308	regsvr32.exe	79
PID 3308 wrote to memory of 2832	3308	regsvr32.exe	79
PID 3308 wrote to memory of 2832	3308	regsvr32.exe	79

C:\Users\Admin\AppData\Local\Temp\dc825fb0f3c7fb28693590a4a5c1cc7f.exe
"C:\Users\Admin\AppData\Local\Temp\dc825fb0f3c7fb28693590a4a5c1cc7f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\DC825F~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\DC825F~1.EXE@508
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\DC825F~1.DLL,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:2832

memory/508-1-0x0000000002730000-0x0000000002731000-memory.dmp

Download