danabot | fc3bbac32a466177b1575504b966baf11e8b7c3aafc4f755818591fb35aaf5d4

Analysis

Target

fc3bbac32a466177b1575504b966baf11e8b7c3aafc4f755818591fb35aaf5d4.exe
Size

1.8MB
MD5

ab31c2d598849285e601ef678552ee29
SHA1

e732ba422aa5a6c6abc13685e7cda9ac7d43b1a5
SHA256

fc3bbac32a466177b1575504b966baf11e8b7c3aafc4f755818591fb35aaf5d4
SHA512

a3069dc5aff9e084a4a1c3e088837d3c46ca6c812ed1c2ed85cb3aac5e6785d57a5444dec71ba8a98084015a30faf9abf7b2e43ea97cf5a00ef96b0c00241eb2

Score

10^/10

Family

danabot

192.119.110.73:443

192.236.192.201:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral1/files/0x000400000001abc8-122.dat	DanabotLoader2021
behavioral1/files/0x000400000001abc8-123.dat	DanabotLoader2021

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4180 created 4200	4180	WerFault.exe	68

Loads dropped DLL 1 IoCs

pid	Process
856	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4180	4200	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 856	4200	fc3bbac32a466177b1575504b966baf11e8b7c3aafc4f755818591fb35aaf5d4.exe	69
PID 4200 wrote to memory of 856	4200	fc3bbac32a466177b1575504b966baf11e8b7c3aafc4f755818591fb35aaf5d4.exe	69
PID 4200 wrote to memory of 856	4200	fc3bbac32a466177b1575504b966baf11e8b7c3aafc4f755818591fb35aaf5d4.exe	69

C:\Users\Admin\AppData\Local\Temp\fc3bbac32a466177b1575504b966baf11e8b7c3aafc4f755818591fb35aaf5d4.exe
"C:\Users\Admin\AppData\Local\Temp\fc3bbac32a466177b1575504b966baf11e8b7c3aafc4f755818591fb35aaf5d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\FC3BBA~1.DLL,s C:\Users\Admin\AppData\Local\Temp\FC3BBA~1.EXE
  2⤵
  - Loads dropped DLL
  PID:856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 548
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4180

memory/4200-118-0x0000000002FAF000-0x000000000313F000-memory.dmp

Filesize
1.6MB

Download
memory/4200-119-0x0000000003140000-0x00000000032E7000-memory.dmp

Filesize
1.7MB

Download
memory/4200-120-0x0000000000400000-0x0000000001207000-memory.dmp

Filesize
14.0MB

Download