danabot | eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d

Analysis

Target

eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe
Size

1.1MB
MD5

d57c5f0618d68902c6b7e8fa7b888641
SHA1

06693ad79544d8f5172d48a938ba949499ba6c60
SHA256

eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d
SHA512

f48c04fad244d0c6d8a6a6d4ca5ae196184f43c18ac981a59101269bf2d8eb0834ad5b0138897c002bf507b0b8e3870afcc92d659035c40f7c246f524a6e9e6d

Score

10^/10

Family

danabot

Botnet

103.175.16.113:443

103.175.16.114:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3920 rundll32.exe

pid	process
3920	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe

description	pid	process	target process
PID 2700 wrote to memory of 3920	2700	eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe	rundll32.exe
PID 2700 wrote to memory of 3920	2700	eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe	rundll32.exe
PID 2700 wrote to memory of 3920	2700	eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe
"C:\Users\Admin\AppData\Local\Temp\eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe.dll,z C:\Users\Admin\AppData\Local\Temp\eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe
2⤵
- Loads dropped DLL
PID:3920

C:\Users\Admin\AppData\Local\Temp\eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe.dll
MD5
d8d75aec08bcd57a9849ae6140c7572d

SHA1
9492d8bb511af197d21322a6aae543803413e823

SHA256
7e4d42303ca1a3ec94ee19f5520a0372d9d440a859b4375c8e572552c0407792

SHA512
5fcda0f25e8bf38f4e44873aada5548038d2fcf617342a8525797145d24b5e9161422dfe09a1b2341254f9911ac7097f9afb4b40c9149610099e9d99441ef96b

Download Submit
\Users\Admin\AppData\Local\Temp\eb5966c02b728346e88e69ac3f63da4ec863a3e0d0754937c0f56799d3718d3d.exe.dll
MD5
d8d75aec08bcd57a9849ae6140c7572d

SHA1
9492d8bb511af197d21322a6aae543803413e823

SHA256
7e4d42303ca1a3ec94ee19f5520a0372d9d440a859b4375c8e572552c0407792

SHA512
5fcda0f25e8bf38f4e44873aada5548038d2fcf617342a8525797145d24b5e9161422dfe09a1b2341254f9911ac7097f9afb4b40c9149610099e9d99441ef96b

Download Submit
memory/2700-116-0x0000000000960000-0x0000000000A5D000-memory.dmp

Filesize
1012KB

Download
memory/2700-115-0x0000000000680000-0x00000000007CA000-memory.dmp

Filesize
1.3MB

Download
memory/2700-117-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/3920-118-0x0000000000000000-mapping.dmp

Download