danabot | 3e25b4da3b5de0a394d9db93d53fc0e76e0a626c5b164d58c96ca9db92547157

Analysis

Target
59108d4c5fa9d804e31c6a6926be5012.exe
Size 1.1MB
Sample210902-19pcv7g9la
SHA256 3e25b4da3b5de0a394d9db93d53fc0e76e0a626c5b164d58c96ca9db92547157
MD5 59108d4c5fa9d804e31c6a6926be5012
SHA1 03f291cad268cd34d0296e8be95d9f680c13e65e
SHA512 8c5e1431de79466e246df3f24fcadf519ad8f19706ca88f5cb8d81aa652c5623cc8ee8c6322c0ae4a472800d2e5d4952f61f98ab1cceed7d266e165e7530d77c
MD5 SHA1 SHA512

Score

10^/10

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001aafd-118.dat	DanabotLoader2021
behavioral2/files/0x000500000001aafd-119.dat	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
15	4008	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4008	rundll32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Gskyj.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4008	3940	59108d4c5fa9d804e31c6a6926be5012.exe	76
PID 3940 wrote to memory of 4008	3940	59108d4c5fa9d804e31c6a6926be5012.exe	76
PID 3940 wrote to memory of 4008	3940	59108d4c5fa9d804e31c6a6926be5012.exe	76

C:\Users\Admin\AppData\Local\Temp\59108d4c5fa9d804e31c6a6926be5012.exe
"C:\Users\Admin\AppData\Local\Temp\59108d4c5fa9d804e31c6a6926be5012.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\59108D~1.DLL,s C:\Users\Admin\AppData\Local\Temp\59108D~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:4008

memory/3940-116-0x0000000000400000-0x000000000222F000-memory.dmp

Download

memory/3940-115-0x0000000004020000-0x0000000004126000-memory.dmp

Download