danabot | b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2

Analysis

Target

b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe
Size

1.8MB
MD5

b9c577e188a9123ce81a75b1a88123a1
SHA1

dc4f1e4b46bec55ea693d904480708d0518005c0
SHA256

b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2
SHA512

e60bbc5ee432f1b3548101937664113b75ad75bdd1ca0539672db71cf1169ec7410b9f75f57d248bce5f4b37c6c8905b40495b2bcb94599979747dca3eae964b

Score

10^/10

Family

danabot

192.119.110.73:443

192.236.192.201:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral1/files/0x000400000001abc5-119.dat	DanabotLoader2021
behavioral1/files/0x000400000001abc5-120.dat	DanabotLoader2021

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2836 created 3288	2836	WerFault.exe	67

Loads dropped DLL 1 IoCs

pid	Process
3776	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	3288	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3776	3288	b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe	71
PID 3288 wrote to memory of 3776	3288	b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe	71
PID 3288 wrote to memory of 3776	3288	b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe	71

C:\Users\Admin\AppData\Local\Temp\b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe
"C:\Users\Admin\AppData\Local\Temp\b324872cf2361acfa11bb5127b260ae226117150ad9d03e481ed08c17f6ca5c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\B32487~1.DLL,s C:\Users\Admin\AppData\Local\Temp\B32487~1.EXE
  2⤵
  - Loads dropped DLL
  PID:3776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 576
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836

memory/3288-115-0x0000000002F6A000-0x00000000030FA000-memory.dmp

Filesize
1.6MB

Download
memory/3288-116-0x0000000003100000-0x00000000032A7000-memory.dmp

Filesize
1.7MB

Download
memory/3288-117-0x0000000000400000-0x0000000001207000-memory.dmp

Filesize
14.0MB

Download