danabot | e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77

Analysis

Target

e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe
Size

1.1MB
MD5

851cdbb4bcb6d6c875fe6d16a05ec685
SHA1

81448d5d276bff2a92f43100df710ef43f040415
SHA256

e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77
SHA512

b73ec26dd18177f636881af462a405c3b82940cf7ee5c840ec42604ebffb01acdbb0749b3eb277925d801f296168f5f472f4af34bcec7a92f2b1e21197390480

Score

10^/10

Family

danabot

Botnet

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1100 rundll32.exe

pid	process
1100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe

description	pid	process	target process
PID 528 wrote to memory of 1100	528	e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe	rundll32.exe
PID 528 wrote to memory of 1100	528	e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe	rundll32.exe
PID 528 wrote to memory of 1100	528	e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe
"C:\Users\Admin\AppData\Local\Temp\e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe.dll,z C:\Users\Admin\AppData\Local\Temp\e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe
2⤵
- Loads dropped DLL
PID:1100

C:\Users\Admin\AppData\Local\Temp\e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe.dll
MD5
a1cbb650dda8f3701028ce6cc9273146

SHA1
de2bd9ffb630b1ff9332255c56c089c78fb10b99

SHA256
b4b5f454c9620a3b123abcccfbd4919576e49636b0f1e455218799f6e3a9aef7

SHA512
eef4df5692955ea41fc79b4875eeb556ae7f974f2fa8fc38c338f16c7373a2702e23dec62e1b83e9de1157213e2ef09c1415c46b29c62635dd3cc33997b6764a

Download Submit
\Users\Admin\AppData\Local\Temp\e684fd32e808410df8fc2558deb61ec472065c28826f0b8dc0d38ae0e5670f77.exe.dll
MD5
a1cbb650dda8f3701028ce6cc9273146

SHA1
de2bd9ffb630b1ff9332255c56c089c78fb10b99

SHA256
b4b5f454c9620a3b123abcccfbd4919576e49636b0f1e455218799f6e3a9aef7

SHA512
eef4df5692955ea41fc79b4875eeb556ae7f974f2fa8fc38c338f16c7373a2702e23dec62e1b83e9de1157213e2ef09c1415c46b29c62635dd3cc33997b6764a

Download Submit
memory/528-115-0x0000000000973000-0x0000000000A56000-memory.dmp

Filesize
908KB

Download
memory/528-116-0x0000000000A60000-0x0000000000B5B000-memory.dmp

Filesize
1004KB

Download
memory/528-117-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/1100-118-0x0000000000000000-mapping.dmp

Download