danabot | c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72

Analysis

Target

c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe
Size

1.1MB
MD5

7f8d63b515602c453d4b82c506f2c9d6
SHA1

8c7d9cfae4b5d5283d85d339c417e4a9a9911a73
SHA256

c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72
SHA512

3bd87d5803ba8180216d522aeec6aa67b7d1df62c6e96d0d2800192f89b2ae577d6d95c6a0b6a96ccf2788de4d33acd642b461b60bfa11cbeb9c96e56a493bf8

Score

10^/10

Family

danabot

Botnet

192.119.110.4:443

103.175.16.113:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3784 rundll32.exe

pid	process
3784	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe

description	pid	process	target process
PID 2428 wrote to memory of 3784	2428	c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe	rundll32.exe
PID 2428 wrote to memory of 3784	2428	c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe	rundll32.exe
PID 2428 wrote to memory of 3784	2428	c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe
"C:\Users\Admin\AppData\Local\Temp\c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe.dll,z C:\Users\Admin\AppData\Local\Temp\c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe
2⤵
- Loads dropped DLL
PID:3784

C:\Users\Admin\AppData\Local\Temp\c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe.dll
MD5
5da1e7e4b3353ce1faacebb0b58fecaf

SHA1
a19c190dbcf4a9afcc451400b2d42879a075f2a4

SHA256
44e5bad330c83a217035069d848f70fcd1ff64a65bff999d638fa27c49b01743

SHA512
af5b78737e28064fe2d721ba76d26e3626022b89d6ff5d94b9b5b770f9016cfbd5de0d6a9ba80280742697e274448d5969e3bebd5da046cc1277a5b358aeb3d7

Download Submit
\Users\Admin\AppData\Local\Temp\c032032a6008322f58be7e4d80ff83e42b5b1dc66c5249bcf24cbc58e6264d72.exe.dll
MD5
5da1e7e4b3353ce1faacebb0b58fecaf

SHA1
a19c190dbcf4a9afcc451400b2d42879a075f2a4

SHA256
44e5bad330c83a217035069d848f70fcd1ff64a65bff999d638fa27c49b01743

SHA512
af5b78737e28064fe2d721ba76d26e3626022b89d6ff5d94b9b5b770f9016cfbd5de0d6a9ba80280742697e274448d5969e3bebd5da046cc1277a5b358aeb3d7

Download Submit
memory/2428-116-0x0000000004A60000-0x0000000004B5C000-memory.dmp

Filesize
1008KB

Download
memory/2428-115-0x0000000004970000-0x0000000004A55000-memory.dmp

Filesize
916KB

Download
memory/2428-117-0x0000000000400000-0x0000000002C56000-memory.dmp

Filesize
40.3MB

Download
memory/3784-118-0x0000000000000000-mapping.dmp

Download