danabot | e73a039e16c6930ac124872d96de31e4bd8e4572c721500a58d5138013bc894e

Analysis

Target

c4ffd1461293fbf57e1278680bdecee7.exe
Size

1.0MB
MD5

c4ffd1461293fbf57e1278680bdecee7
SHA1

8acfb814bbcef5be5b2180efabcb3c6785ae76db
SHA256

e73a039e16c6930ac124872d96de31e4bd8e4572c721500a58d5138013bc894e
SHA512

12f78148263d50d98989c496be6fe062b04cfdbdea2be3f1f8b7217850bf47829cea7c61f7103dd9d865462b8b4937fb98d00994a594a4e70564dab714843dfe

Score

10^/10

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL	DanabotLoader2021
behavioral2/memory/788-120-0x0000000004420000-0x0000000004583000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

19 788 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

788 rundll32.exe
788 rundll32.exe

flow	pid	process
19	788	rundll32.exe

pid	process
788	rundll32.exe
788	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c4ffd1461293fbf57e1278680bdecee7.exe

description	pid	process	target process
PID 620 wrote to memory of 788	620	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe
PID 620 wrote to memory of 788	620	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe
PID 620 wrote to memory of 788	620	c4ffd1461293fbf57e1278680bdecee7.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\c4ffd1461293fbf57e1278680bdecee7.exe
"C:\Users\Admin\AppData\Local\Temp\c4ffd1461293fbf57e1278680bdecee7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:620

C:\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL
MD5
5ee82cac7cb1730fa2775a39938d8638

SHA1
bdd59bd7c58b350cbb78a2177abc23fc6c4dcd5e

SHA256
8622f779c3016ed8b9ab385e26a71cd896768308d947bad59732baf18f1de041

SHA512
b7c2f81220f20fc54e2217ec47e782fe3084f23087bf25f4302ddfe83f5858a7fc7f4966d6b77b7b598ab3803f8af2850cf6b738259a4eada854be07ad40129a

Download Submit
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL
MD5
5ee82cac7cb1730fa2775a39938d8638

SHA1
bdd59bd7c58b350cbb78a2177abc23fc6c4dcd5e

SHA256
8622f779c3016ed8b9ab385e26a71cd896768308d947bad59732baf18f1de041

SHA512
b7c2f81220f20fc54e2217ec47e782fe3084f23087bf25f4302ddfe83f5858a7fc7f4966d6b77b7b598ab3803f8af2850cf6b738259a4eada854be07ad40129a

Download Submit
\Users\Admin\AppData\Local\Temp\C4FFD1~1.DLL
MD5
5ee82cac7cb1730fa2775a39938d8638

SHA1
bdd59bd7c58b350cbb78a2177abc23fc6c4dcd5e

SHA256
8622f779c3016ed8b9ab385e26a71cd896768308d947bad59732baf18f1de041

SHA512
b7c2f81220f20fc54e2217ec47e782fe3084f23087bf25f4302ddfe83f5858a7fc7f4966d6b77b7b598ab3803f8af2850cf6b738259a4eada854be07ad40129a

Download Submit
memory/620-114-0x00000000025D0000-0x00000000026D6000-memory.dmp

Filesize
1.0MB

Download
memory/620-115-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/788-116-0x0000000000000000-mapping.dmp

Download
memory/788-120-0x0000000004420000-0x0000000004583000-memory.dmp

Filesize
1.4MB

Download