danabot | 82abbdee746d652b3300c458d251e3b858dfa66b287049608cd4eb3d6cf3b3f8

Analysis

Target

4c7997ac51cbffb25df9984253791780.exe
Size

1.2MB
MD5

4c7997ac51cbffb25df9984253791780
SHA1

e1d0624c2ba2febd6ae5f85c69d54761911462e8
SHA256

82abbdee746d652b3300c458d251e3b858dfa66b287049608cd4eb3d6cf3b3f8
SHA512

8027c936d3aea6242ff6627e0118b7d7c54f58138db8794801e309c9ff571e4aee3ab70f37a83d2fe600137d26d2bfe429d63fb8f6519246c8d2ccfa9537fd4f

Score

10^/10

Family

danabot

23.229.29.48:443

5.9.224.204:443

192.255.166.212:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\4C7997~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\4C7997~1.DLL	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

13 1016 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1016 rundll32.exe
Drops file in Program Files directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\PROGRA~3\Gskyj.tmp rundll32.exe

flow	pid	process
13	1016	rundll32.exe

pid	process
1016	rundll32.exe

description	ioc	process
File created	C:\PROGRA~3\Gskyj.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4c7997ac51cbffb25df9984253791780.exe

description	pid	process	target process
PID 364 wrote to memory of 1016	364	4c7997ac51cbffb25df9984253791780.exe	rundll32.exe
PID 364 wrote to memory of 1016	364	4c7997ac51cbffb25df9984253791780.exe	rundll32.exe
PID 364 wrote to memory of 1016	364	4c7997ac51cbffb25df9984253791780.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\4c7997ac51cbffb25df9984253791780.exe
"C:\Users\Admin\AppData\Local\Temp\4c7997ac51cbffb25df9984253791780.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4C7997~1.DLL,s C:\Users\Admin\AppData\Local\Temp\4C7997~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:1016

C:\Users\Admin\AppData\Local\Temp\4C7997~1.DLL

MD5
33ae9e9407064e4a8d16a47a571da5ee

SHA1
c870ff88a0c325c5d4f1a663a194052ad345258f

SHA256
cf3023c69ca97028dd0c0067e8b01c9c0ac259686757eb9edab2bccfedc02df8

SHA512
563a359fa5cddde36b3992cc77946d97838aa49616efdb54065794612e6acd0a1e8f2208fb8dc89cf43e5f1ab562bd03c65bc9a379e841ba6220502886dcdca0

Download Submit
\Users\Admin\AppData\Local\Temp\4C7997~1.DLL

MD5
33ae9e9407064e4a8d16a47a571da5ee

SHA1
c870ff88a0c325c5d4f1a663a194052ad345258f

SHA256
cf3023c69ca97028dd0c0067e8b01c9c0ac259686757eb9edab2bccfedc02df8

SHA512
563a359fa5cddde36b3992cc77946d97838aa49616efdb54065794612e6acd0a1e8f2208fb8dc89cf43e5f1ab562bd03c65bc9a379e841ba6220502886dcdca0

Download Submit
memory/364-114-0x00000000036F0000-0x00000000037F5000-memory.dmp

Filesize
1.0MB

Download
memory/364-115-0x0000000000400000-0x0000000001860000-memory.dmp

Filesize
20.4MB

Download
memory/1016-116-0x0000000000000000-mapping.dmp

Download