danabot | 4dbfdae091635ba9e56b2b0c4b25523e5e16e373786cfaa3065e0cea730746fb

Analysis

Target
4886d9d33e6049b84159ee4681c9b712.exe
Size 1.0MB
Sample210815-pp2anknvw6
SHA256 4dbfdae091635ba9e56b2b0c4b25523e5e16e373786cfaa3065e0cea730746fb
MD5 4886d9d33e6049b84159ee4681c9b712
SHA1 88b47e47bdc66a010769d239122203896f4b4c37
SHA512 29c049e4f9df878834b74e371839198525c6a1feac89f39a6f788aebb57a5953125bc3eaa5566b9d0fc08c9a8a8db151ef292f8956bbbf6c6af4cb88b98cac99
MD5 SHA1 SHA512

Score

10^/10

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral2/files/0x000200000001ab4c-115.dat	DanabotLoader2021
behavioral2/files/0x000200000001ab4c-116.dat	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	2168	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2168	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 2168	3916	4886d9d33e6049b84159ee4681c9b712.exe	76
PID 3916 wrote to memory of 2168	3916	4886d9d33e6049b84159ee4681c9b712.exe	76
PID 3916 wrote to memory of 2168	3916	4886d9d33e6049b84159ee4681c9b712.exe	76

C:\Users\Admin\AppData\Local\Temp\4886d9d33e6049b84159ee4681c9b712.exe
"C:\Users\Admin\AppData\Local\Temp\4886d9d33e6049b84159ee4681c9b712.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4886D9~1.TMP,S C:\Users\Admin\AppData\Local\Temp\4886D9~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2168

memory/3916-117-0x0000000004BB0000-0x0000000004CAE000-memory.dmp

Download

memory/3916-118-0x0000000000400000-0x0000000002D97000-memory.dmp

Download