danabot | dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a

Analysis

Target

dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe
Size

1.1MB
MD5

2c6a56531ca6a40bad045d445068bc65
SHA1

1e0fb9085ee80918a31cbe419e3fc7bc019e6ae3
SHA256

dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a
SHA512

3ae28eb9349b0416d885068ae13de12702b6f9afea9602d31c7ca275937aa4a8716ee312c94ca9daf3ee04c69030e465681c38aa2f9aabe42d9e0bd1acd5d336

Score

10^/10

Family

danabot

Botnet

192.119.110.4:443

103.175.16.113:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3340 rundll32.exe

pid	process
3340	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe

description	pid	process	target process
PID 2740 wrote to memory of 3340	2740	dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe	rundll32.exe
PID 2740 wrote to memory of 3340	2740	dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe	rundll32.exe
PID 2740 wrote to memory of 3340	2740	dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe
"C:\Users\Admin\AppData\Local\Temp\dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe.dll,z C:\Users\Admin\AppData\Local\Temp\dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe
2⤵
- Loads dropped DLL
PID:3340

C:\Users\Admin\AppData\Local\Temp\dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe.dll
MD5
ae830beb2f6327a2d6046258c50d8097

SHA1
169d622307c4f687d863d912821f8b0867e937c0

SHA256
4d4e507a2ce80020a15a1410372ce5e3ad39d117df3d4fea161f0eb178b717d6

SHA512
ad2a942dd10c2dae8b3f1f1ca3893c598857d860b1bd05ffbd9692be13f23a20b3ff9759b6755521fa1d48f56e1056e0e7f80ee6ee58dfd0a62c07f93a891697

Download Submit
\Users\Admin\AppData\Local\Temp\dc568569e0ae1b0b109b6c64e9523adc27af416737c2cb594fd930e89c11a71a.exe.dll
MD5
ae830beb2f6327a2d6046258c50d8097

SHA1
169d622307c4f687d863d912821f8b0867e937c0

SHA256
4d4e507a2ce80020a15a1410372ce5e3ad39d117df3d4fea161f0eb178b717d6

SHA512
ad2a942dd10c2dae8b3f1f1ca3893c598857d860b1bd05ffbd9692be13f23a20b3ff9759b6755521fa1d48f56e1056e0e7f80ee6ee58dfd0a62c07f93a891697

Download Submit
memory/2740-116-0x0000000004CE0000-0x0000000004DDC000-memory.dmp

Filesize
1008KB

Download
memory/2740-115-0x0000000004BF0000-0x0000000004CD5000-memory.dmp

Filesize
916KB

Download
memory/2740-117-0x0000000000400000-0x0000000002C56000-memory.dmp

Filesize
40.3MB

Download
memory/3340-118-0x0000000000000000-mapping.dmp

Download