danabot | 17358150c0bb9ce944b33e0c46d69101e60bd70f08a32bb5134d0ea3847255ee

Analysis

Target

82254c91d741682cf5f7163b7c33bad5.exe
Size

1.1MB
MD5

82254c91d741682cf5f7163b7c33bad5
SHA1

b642c67d69650d6d241746d10c4f773a62a21f52
SHA256

17358150c0bb9ce944b33e0c46d69101e60bd70f08a32bb5134d0ea3847255ee
SHA512

7b5b40b1ec9a20c61984a823de136f16e93606ae5db64918569168c16c780744aba89d6d64abcb4376561acd251dfd2167b6f58d33fe33f391d34ec8735df0c7

Score

10^/10

Family

danabot

Botnet

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\82254c91d741682cf5f7163b7c33bad5.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\82254c91d741682cf5f7163b7c33bad5.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3652 rundll32.exe

pid	process
3652	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

82254c91d741682cf5f7163b7c33bad5.exe

description	pid	process	target process
PID 2712 wrote to memory of 3652	2712	82254c91d741682cf5f7163b7c33bad5.exe	rundll32.exe
PID 2712 wrote to memory of 3652	2712	82254c91d741682cf5f7163b7c33bad5.exe	rundll32.exe
PID 2712 wrote to memory of 3652	2712	82254c91d741682cf5f7163b7c33bad5.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\82254c91d741682cf5f7163b7c33bad5.exe
"C:\Users\Admin\AppData\Local\Temp\82254c91d741682cf5f7163b7c33bad5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\82254c91d741682cf5f7163b7c33bad5.exe.dll,z C:\Users\Admin\AppData\Local\Temp\82254c91d741682cf5f7163b7c33bad5.exe
2⤵
- Loads dropped DLL
PID:3652

C:\Users\Admin\AppData\Local\Temp\82254c91d741682cf5f7163b7c33bad5.exe.dll
MD5
a3ec4a449d6609b025f1e7ff8b842953

SHA1
43de5081aa055a09f498676ede9f6986e3ea6cc3

SHA256
217330c95eaeb71719327a5633da62e8008b6a57d2ccd7d4a60b6459a1d35588

SHA512
99e5731dfb4decf4c7feca88f632c05f4c4a87c9665a7238fd39d92cc16c7b8745d61415548501af2e83625c8cafbfcc63fc429d9cd8074a564cd956a874074c

Download Submit
\Users\Admin\AppData\Local\Temp\82254c91d741682cf5f7163b7c33bad5.exe.dll
MD5
a3ec4a449d6609b025f1e7ff8b842953

SHA1
43de5081aa055a09f498676ede9f6986e3ea6cc3

SHA256
217330c95eaeb71719327a5633da62e8008b6a57d2ccd7d4a60b6459a1d35588

SHA512
99e5731dfb4decf4c7feca88f632c05f4c4a87c9665a7238fd39d92cc16c7b8745d61415548501af2e83625c8cafbfcc63fc429d9cd8074a564cd956a874074c

Download Submit
memory/2712-116-0x0000000002580000-0x000000000267C000-memory.dmp

Filesize
1008KB

Download
memory/2712-117-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/2712-115-0x0000000002490000-0x0000000002574000-memory.dmp

Filesize
912KB

Download
memory/3652-118-0x0000000000000000-mapping.dmp

Download