danabot | d447a466b5bed2daffcd7a3ea6fea93a8d9fa32d62eadbf834d3a8713da05a4a

Analysis

Target
12f1cb18016343fe5ec091c042b31668.exe
Size 2.6MB
Sample201109-wbep91sgps
SHA256 d447a466b5bed2daffcd7a3ea6fea93a8d9fa32d62eadbf834d3a8713da05a4a
MD5 12f1cb18016343fe5ec091c042b31668
SHA1 84d515f65d5e6eb057f2c267be836af04b353b60
SHA512 a2b7c47ea0d2ea0ab15c22b776998aed2b5cd1b06da3d02839fc315b049cda7cd955f16439f1b3565a9fe8d1d68acd7ca2ff337aa2ad301b7f21ebead10fb0ed
MD5 SHA1 SHA512

Score

10^/10

Family

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 3 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

Blocklisted process makes network request 9 IoCs

Loads dropped DLL 2 IoCs

pid	Process
3116	regsvr32.exe
196	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3116	640	12f1cb18016343fe5ec091c042b31668.exe	78
PID 640 wrote to memory of 3116	640	12f1cb18016343fe5ec091c042b31668.exe	78
PID 640 wrote to memory of 3116	640	12f1cb18016343fe5ec091c042b31668.exe	78
PID 3116 wrote to memory of 196	3116	regsvr32.exe	79
PID 3116 wrote to memory of 196	3116	regsvr32.exe	79
PID 3116 wrote to memory of 196	3116	regsvr32.exe	79

C:\Users\Admin\AppData\Local\Temp\12f1cb18016343fe5ec091c042b31668.exe
"C:\Users\Admin\AppData\Local\Temp\12f1cb18016343fe5ec091c042b31668.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\12F1CB~1.EXE@640
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\12F1CB~1.DLL,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:196

memory/640-1-0x0000000002640000-0x0000000002641000-memory.dmp

Download