danabot | 9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12

Analysis

Target

9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe
Size

1.1MB
MD5

a8c9c70c215549f68555476f80cd20e9
SHA1

d499cf0f21c0fba8aaf6e0eb44d4bca3d754da5c
SHA256

9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12
SHA512

1be51796ed8fd6c6807be48e0e2b13721d15ba6498587ce2e1121df13ff3176dd38e44d0561b53542e4355ac43fbda60d7ea1660f82534e18f1d4c1bfd911abc

Score

10^/10

Family

danabot

Botnet

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3412 rundll32.exe

pid	process
3412	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe

description	pid	process	target process
PID 2620 wrote to memory of 3412	2620	9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe	rundll32.exe
PID 2620 wrote to memory of 3412	2620	9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe	rundll32.exe
PID 2620 wrote to memory of 3412	2620	9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe
"C:\Users\Admin\AppData\Local\Temp\9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe.dll,z C:\Users\Admin\AppData\Local\Temp\9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe
2⤵
- Loads dropped DLL
PID:3412

C:\Users\Admin\AppData\Local\Temp\9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe.dll
MD5
63e7721d625a817cbc42fb1ea865e85f

SHA1
e363acb56fc9622beee848ce28e922fdde044428

SHA256
73efda7fdc00bcf22b46900628bee1beba0057d3fa851b9a40117fe7779510a7

SHA512
7e104be4a0d277fefdfae170e6b8edfd7563a9705a6aaa759d459bbec04f5ea946c89eaadb620d3ab9f8ea9ef77c8c3c18ceaf94103a8236828094bf500924cd

Download Submit
\Users\Admin\AppData\Local\Temp\9ebcbf93b00f37d17be91cc3dac5ee946f6a7535600d41990d692bfc8bc43c12.exe.dll
MD5
63e7721d625a817cbc42fb1ea865e85f

SHA1
e363acb56fc9622beee848ce28e922fdde044428

SHA256
73efda7fdc00bcf22b46900628bee1beba0057d3fa851b9a40117fe7779510a7

SHA512
7e104be4a0d277fefdfae170e6b8edfd7563a9705a6aaa759d459bbec04f5ea946c89eaadb620d3ab9f8ea9ef77c8c3c18ceaf94103a8236828094bf500924cd

Download Submit
memory/2620-115-0x000000000097F000-0x0000000000A62000-memory.dmp

Filesize
908KB

Download
memory/2620-116-0x0000000000A70000-0x0000000000B6B000-memory.dmp

Filesize
1004KB

Download
memory/2620-117-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/3412-118-0x0000000000000000-mapping.dmp

Download