danabot | 94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b

Analysis

Target

94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe
Size

1.1MB
MD5

fbc154f362d0d6a0ded11664d27f2ea4
SHA1

d878d204a902b674ad1d1776e1172b5990082f92
SHA256

94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b
SHA512

ba574b0047728a5709621ef8b16ba7642326ed3d26b046ef278c74d5d4e745219ea45af66ee42e22eefb495186356a2ae73448859a84f526ab5bbfe9390d6013

Score

10^/10

Family

danabot

Botnet

142.11.244.223:443

192.236.194.72:443

192.119.110.4:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1516 rundll32.exe

pid	process
1516	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe

description	pid	process	target process
PID 948 wrote to memory of 1516	948	94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe	rundll32.exe
PID 948 wrote to memory of 1516	948	94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe	rundll32.exe
PID 948 wrote to memory of 1516	948	94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe
"C:\Users\Admin\AppData\Local\Temp\94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe.dll,z C:\Users\Admin\AppData\Local\Temp\94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe
2⤵
- Loads dropped DLL
PID:1516

C:\Users\Admin\AppData\Local\Temp\94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe.dll
MD5
5b7fc543fd2067429aca14f2560ad257

SHA1
1398524e708868b5c94dbd477a941dfbcdcc06e4

SHA256
289742b820407a64f1d16c6fdea49619280b31a38674e3159f66d15ca9bab594

SHA512
1a23014d3d462b568f4e2e45fdec277368ee64c3ca953c7ca2e570a791e41769cd60fad75021eb7957b21b7deb46a5beead01b3000acaa0563f3c42080965cd6

Download Submit
\Users\Admin\AppData\Local\Temp\94f5f6529944c9b5eda9a8a5cadb6b5b97c29dc338a6b018aa0145890e3b2b3b.exe.dll
MD5
5b7fc543fd2067429aca14f2560ad257

SHA1
1398524e708868b5c94dbd477a941dfbcdcc06e4

SHA256
289742b820407a64f1d16c6fdea49619280b31a38674e3159f66d15ca9bab594

SHA512
1a23014d3d462b568f4e2e45fdec277368ee64c3ca953c7ca2e570a791e41769cd60fad75021eb7957b21b7deb46a5beead01b3000acaa0563f3c42080965cd6

Download Submit
memory/948-115-0x00000000008A2000-0x0000000000985000-memory.dmp

Filesize
908KB

Download
memory/948-116-0x0000000000990000-0x0000000000A8A000-memory.dmp

Filesize
1000KB

Download
memory/948-117-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/1516-118-0x0000000000000000-mapping.dmp

Download