danabot | 3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0

Analysis

Target

3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0.exe
Size

1.8MB
MD5

eccbe02e557ad19e5445a9f1523f1c3d
SHA1

675d681f5da40f365ce2b3e8f55ed259a40a1fdd
SHA256

3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0
SHA512

8cbd6e5884ceb900c2755991fd145a5ce9af5ec012c1bff5a057e889b544e83aa55322ca444c36129a7e452dce364999a34828b63601564a89d3e19767affdbd

Score

10^/10

Family

danabot

142.11.244.223:443

23.106.122.139:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000000689-122.dat	DanabotLoader2021
behavioral1/files/0x0007000000000689-123.dat	DanabotLoader2021

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 432 created 3368	432	WerFault.exe	68

Loads dropped DLL 1 IoCs

pid	Process
3024	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
432	3368	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3024	3368	3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0.exe	69
PID 3368 wrote to memory of 3024	3368	3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0.exe	69
PID 3368 wrote to memory of 3024	3368	3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0.exe	69

C:\Users\Admin\AppData\Local\Temp\3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0.exe
"C:\Users\Admin\AppData\Local\Temp\3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3E2E7A~1.DLL,s C:\Users\Admin\AppData\Local\Temp\3E2E7A~1.EXE
  2⤵
  - Loads dropped DLL
  PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 552
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432

memory/3368-118-0x0000000004B81000-0x0000000004D0F000-memory.dmp

Filesize
1.6MB

Download
memory/3368-119-0x0000000004D10000-0x0000000004EB5000-memory.dmp

Filesize
1.6MB

Download
memory/3368-120-0x0000000000400000-0x0000000002CBF000-memory.dmp

Filesize
40.7MB

Download