danabot | 3ee5f1884ca0261665ff87cc41c7aa590aaac03b3f53dd8edfdaeefc42f869c1

Analysis

Target
5f6df8db48f0651d13a8618db5cfda3e.exe
Size 1.1MB
Sample210816-6hwqg47xae
SHA256 3ee5f1884ca0261665ff87cc41c7aa590aaac03b3f53dd8edfdaeefc42f869c1
MD5 5f6df8db48f0651d13a8618db5cfda3e
SHA1 6019289e5ce3649f754f6d6252e09a754911ba9e
SHA512 bc55b589192e78eb2592d15956f328b4b05db2f16831dcc950f881f232513bf07d87bd2e1dff8b9a23b7bf4d8e05a6d3225b7b179bf010f5fd96acfcdd00a302
MD5 SHA1 SHA512

Score

10^/10

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral2/files/0x000200000001ab56-115.dat	DanabotLoader2021
behavioral2/files/0x000200000001ab56-116.dat	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
15	3512	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
3512	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3512	3908	5f6df8db48f0651d13a8618db5cfda3e.exe	76
PID 3908 wrote to memory of 3512	3908	5f6df8db48f0651d13a8618db5cfda3e.exe	76
PID 3908 wrote to memory of 3512	3908	5f6df8db48f0651d13a8618db5cfda3e.exe	76

C:\Users\Admin\AppData\Local\Temp\5f6df8db48f0651d13a8618db5cfda3e.exe
"C:\Users\Admin\AppData\Local\Temp\5f6df8db48f0651d13a8618db5cfda3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\5F6DF8~1.TMP,S C:\Users\Admin\AppData\Local\Temp\5F6DF8~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:3512

memory/3908-118-0x0000000000400000-0x0000000002D9A000-memory.dmp

Download

memory/3908-117-0x0000000004C50000-0x0000000004D4E000-memory.dmp

Download