danabot | e73a039e16c6930ac124872d96de31e4bd8e4572c721500a58d5138013bc894e

General

Target

c4ffd1461293fbf57e1278680bdecee7.exe
Size

1.0MB
MD5

c4ffd1461293fbf57e1278680bdecee7
SHA1

8acfb814bbcef5be5b2180efabcb3c6785ae76db
SHA256

e73a039e16c6930ac124872d96de31e4bd8e4572c721500a58d5138013bc894e
SHA512

12f78148263d50d98989c496be6fe062b04cfdbdea2be3f1f8b7217850bf47829cea7c61f7103dd9d865462b8b4937fb98d00994a594a4e70564dab714843dfe

Score

10^/10

danabot banker trojan

Malware Config

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL	DanabotLoader2021
behavioral1/memory/1404-62-0x0000000000610000-0x0000000000773000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1404 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1404 rundll32.exe
1404 rundll32.exe
1404 rundll32.exe
1404 rundll32.exe

flow	pid	process
2	1404	rundll32.exe

pid	process
1404	rundll32.exe
1404	rundll32.exe
1404	rundll32.exe
1404	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c4ffd1461293fbf57e1278680bdecee7.exe

description	pid	process	target process
PID 2040 wrote to memory of 1404	2040	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe
PID 2040 wrote to memory of 1404	2040	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe
PID 2040 wrote to memory of 1404	2040	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe
PID 2040 wrote to memory of 1404	2040	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe
PID 2040 wrote to memory of 1404	2040	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe
PID 2040 wrote to memory of 1404	2040	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe
PID 2040 wrote to memory of 1404	2040	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\c4ffd1461293fbf57e1278680bdecee7.exe
"C:\Users\Admin\AppData\Local\Temp\c4ffd1461293fbf57e1278680bdecee7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL,s C:\Users\Admin\AppData\Local\Temp\C4FFD1~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL
MD5
348a5ab4eed6e036c1c0a1d091baf33f

SHA1
55dd1a2a3b5fdf3568cb185c6a703624c744fd02

SHA256
6baa762513b4b177cdc5b07e164c74cce945d3f436eb44701464bd91459a0166

SHA512
73329d44e343c09014780c8c89eb471d60a1093dec7bf65ad5f1a1bba1dcc2ff0e9832c221f2244ae901826bb7843a491bfe567f02ad1478af17dc50e11703fd

Download Submit
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL
MD5
348a5ab4eed6e036c1c0a1d091baf33f

SHA1
55dd1a2a3b5fdf3568cb185c6a703624c744fd02

SHA256
6baa762513b4b177cdc5b07e164c74cce945d3f436eb44701464bd91459a0166

SHA512
73329d44e343c09014780c8c89eb471d60a1093dec7bf65ad5f1a1bba1dcc2ff0e9832c221f2244ae901826bb7843a491bfe567f02ad1478af17dc50e11703fd

Download Submit
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL
MD5
348a5ab4eed6e036c1c0a1d091baf33f

SHA1
55dd1a2a3b5fdf3568cb185c6a703624c744fd02

SHA256
6baa762513b4b177cdc5b07e164c74cce945d3f436eb44701464bd91459a0166

SHA512
73329d44e343c09014780c8c89eb471d60a1093dec7bf65ad5f1a1bba1dcc2ff0e9832c221f2244ae901826bb7843a491bfe567f02ad1478af17dc50e11703fd

Download Submit
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL
MD5
348a5ab4eed6e036c1c0a1d091baf33f

SHA1
55dd1a2a3b5fdf3568cb185c6a703624c744fd02

SHA256
6baa762513b4b177cdc5b07e164c74cce945d3f436eb44701464bd91459a0166

SHA512
73329d44e343c09014780c8c89eb471d60a1093dec7bf65ad5f1a1bba1dcc2ff0e9832c221f2244ae901826bb7843a491bfe567f02ad1478af17dc50e11703fd

Download Submit
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL
MD5
348a5ab4eed6e036c1c0a1d091baf33f

SHA1
55dd1a2a3b5fdf3568cb185c6a703624c744fd02

SHA256
6baa762513b4b177cdc5b07e164c74cce945d3f436eb44701464bd91459a0166

SHA512
73329d44e343c09014780c8c89eb471d60a1093dec7bf65ad5f1a1bba1dcc2ff0e9832c221f2244ae901826bb7843a491bfe567f02ad1478af17dc50e11703fd

Download Submit
memory/1404-54-0x0000000000000000-mapping.dmp

Download
memory/1404-62-0x0000000000610000-0x0000000000773000-memory.dmp

Filesize
1.4MB

Download
memory/2040-53-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/2040-61-0x0000000001F70000-0x0000000002076000-memory.dmp

Filesize
1.0MB

Download
memory/2040-63-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads