danabot | de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2

Analysis

Target

de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe
Size

1.1MB
MD5

a91defb7b648925263051ec7fd201c94
SHA1

76a5a4630de67311340bc86b5f3c04937a546015
SHA256

de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2
SHA512

2cf63e77e06ff98ee1bf91d54cd5094bcd6f81eeb3721fc3ffff18c315b195a99f7f1fdc8170d6f9ccb935f9b6d3cd14ad64b4985431037197fc0ba2f0356170

Score

10^/10

Family

danabot

Botnet

142.11.244.223:443

192.236.194.72:443

192.119.110.4:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4092 rundll32.exe

pid	process
4092	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe

description	pid	process	target process
PID 2700 wrote to memory of 4092	2700	de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe	rundll32.exe
PID 2700 wrote to memory of 4092	2700	de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe	rundll32.exe
PID 2700 wrote to memory of 4092	2700	de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe
"C:\Users\Admin\AppData\Local\Temp\de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe.dll,z C:\Users\Admin\AppData\Local\Temp\de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe
2⤵
- Loads dropped DLL
PID:4092

C:\Users\Admin\AppData\Local\Temp\de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe.dll
MD5
8a8261a370cbd9c3ecd89e2baff67b3c

SHA1
589860117c73498f0a5371fe089fd6b31fd4b376

SHA256
8b90653b607ea6d1c40e796eadbeb9b325b6df5eb87e8f800cfec78807a0fdab

SHA512
0f5f0f31c4f18a54390ca2451def8f201f42f918890ec43cb9ba128210606d42752019f6fe8b7855805c320069c7042d907261bfb523a4b5bab63961ea9ef9e6

Download Submit
\Users\Admin\AppData\Local\Temp\de041e8c31ea6d8d05533730d1fa3ee11b74d3b98155693e19a68af8212c1ea2.exe.dll
MD5
8a8261a370cbd9c3ecd89e2baff67b3c

SHA1
589860117c73498f0a5371fe089fd6b31fd4b376

SHA256
8b90653b607ea6d1c40e796eadbeb9b325b6df5eb87e8f800cfec78807a0fdab

SHA512
0f5f0f31c4f18a54390ca2451def8f201f42f918890ec43cb9ba128210606d42752019f6fe8b7855805c320069c7042d907261bfb523a4b5bab63961ea9ef9e6

Download Submit
memory/2700-116-0x00000000008A0000-0x000000000099A000-memory.dmp

Filesize
1000KB

Download
memory/2700-117-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4092-118-0x0000000000000000-mapping.dmp

Download