danabot | 7d3b2e91c3cfb16df02f63b973c69a2047b8031295a49e4fffa0fad3dba975f0

Analysis

Target

f8151b5d4c4e62166a8c2e914f54cbb7.exe
Size

1.1MB
MD5

f8151b5d4c4e62166a8c2e914f54cbb7
SHA1

ee9da83f51b904db29d14847a013c4cff7ea6711
SHA256

7d3b2e91c3cfb16df02f63b973c69a2047b8031295a49e4fffa0fad3dba975f0
SHA512

0e141cee03549a768d284381bd8751b3b3b18805bffa1ada7e4a7c44c3d50fae190d6a4d82ddaee76c82f2a853190549a2d6d1f3a3fdfef425cff3499933b084

Score

10^/10

Family

danabot

Botnet

192.119.110.4:443

192.236.194.72:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\f8151b5d4c4e62166a8c2e914f54cbb7.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\f8151b5d4c4e62166a8c2e914f54cbb7.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2252 rundll32.exe

pid	process
2252	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f8151b5d4c4e62166a8c2e914f54cbb7.exe

description	pid	process	target process
PID 3776 wrote to memory of 2252	3776	f8151b5d4c4e62166a8c2e914f54cbb7.exe	rundll32.exe
PID 3776 wrote to memory of 2252	3776	f8151b5d4c4e62166a8c2e914f54cbb7.exe	rundll32.exe
PID 3776 wrote to memory of 2252	3776	f8151b5d4c4e62166a8c2e914f54cbb7.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\f8151b5d4c4e62166a8c2e914f54cbb7.exe
"C:\Users\Admin\AppData\Local\Temp\f8151b5d4c4e62166a8c2e914f54cbb7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8151b5d4c4e62166a8c2e914f54cbb7.exe.dll,z C:\Users\Admin\AppData\Local\Temp\f8151b5d4c4e62166a8c2e914f54cbb7.exe
2⤵
- Loads dropped DLL
PID:2252

C:\Users\Admin\AppData\Local\Temp\f8151b5d4c4e62166a8c2e914f54cbb7.exe.dll
MD5
652b69278d2c1ab7d60566d4f69cf027

SHA1
d75eddfa173bc189caf0e8bbf8a5931757d8f775

SHA256
1d9f77cff0851c4d8009f673032e7ec109aec9a4c9224ee1ee9d07575c18d173

SHA512
f0eff57e0442654008bd2e5779b1cfcf24a0ff43870338a538b7cb8370cbdc756728b6a9de66849617709b35c8396247a37f08a50963bdc07b353b525879a503

Download Submit
\Users\Admin\AppData\Local\Temp\f8151b5d4c4e62166a8c2e914f54cbb7.exe.dll
MD5
652b69278d2c1ab7d60566d4f69cf027

SHA1
d75eddfa173bc189caf0e8bbf8a5931757d8f775

SHA256
1d9f77cff0851c4d8009f673032e7ec109aec9a4c9224ee1ee9d07575c18d173

SHA512
f0eff57e0442654008bd2e5779b1cfcf24a0ff43870338a538b7cb8370cbdc756728b6a9de66849617709b35c8396247a37f08a50963bdc07b353b525879a503

Download Submit
memory/2252-118-0x0000000000000000-mapping.dmp

Download
memory/3776-116-0x0000000004B00000-0x0000000004BFA000-memory.dmp

Filesize
1000KB

Download
memory/3776-115-0x0000000004A10000-0x0000000004AF2000-memory.dmp

Filesize
904KB

Download
memory/3776-117-0x0000000000400000-0x0000000002C53000-memory.dmp

Filesize
40.3MB

Download