danabot | 301fb66cb50056dca7644f1b087a2bfbba0f9649a8e5571fe1845d704cd78913

Analysis

Target
SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe
Size 940KB
Sample201109-syvd38f85x
SHA256 301fb66cb50056dca7644f1b087a2bfbba0f9649a8e5571fe1845d704cd78913
MD5 c67f60855d4ba3d15799f99b3fe23cf6
SHA1 59a33e61e3f5e31bd56405b23ba59dcc1d3e9012
SHA512 d33e2eaafb7356db222a6f533d691aac0df4b7f6043cfbd062d38bcf4156b5840d2720dc83a66b0b69e3f1e432f5199112fe42556e9d9cb3b49b53689c7d2a6a
MD5 SHA1 SHA512

Score

10^/10

Family

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 4 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

Blocklisted process makes network request 7 IoCs

Loads dropped DLL 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 1760	428	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	77
PID 428 wrote to memory of 1760	428	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	77
PID 428 wrote to memory of 1760	428	SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe	77
PID 1760 wrote to memory of 184	1760	regsvr32.exe	78
PID 1760 wrote to memory of 184	1760	regsvr32.exe	78
PID 1760 wrote to memory of 184	1760	regsvr32.exe	78

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Danabot.2.7796.25479.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@428
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:184