danabot | fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56

Analysis

Target

fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe
Size

1.1MB
MD5

2006d6aabb42d217e6186b993619c963
SHA1

e57f70eb2106e22147b66c03cd18803d634ce3af
SHA256

fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56
SHA512

7da84faa4850d41ee77238cb43fd37864fa2a02c163f93ab9c04cfad63b9fe6be9c36458179e55943eed984986ae26dfce9326805e3423ef3b51f5aee915e6d6

Score

10^/10

Family

danabot

Botnet

103.175.16.113:443

103.175.16.114:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3920 rundll32.exe

pid	process
3920	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe

description	pid	process	target process
PID 3964 wrote to memory of 3920	3964	fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe	rundll32.exe
PID 3964 wrote to memory of 3920	3964	fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe	rundll32.exe
PID 3964 wrote to memory of 3920	3964	fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe
"C:\Users\Admin\AppData\Local\Temp\fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe.dll,z C:\Users\Admin\AppData\Local\Temp\fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe
2⤵
- Loads dropped DLL
PID:3920

C:\Users\Admin\AppData\Local\Temp\fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe.dll
MD5
ca87e069969707b41a59e553cdc2ac44

SHA1
bac1c6a0adcfe79999749e25dbdc02f825cab5e6

SHA256
5f35bc6900ead503e6b04132f834a12ec15d2c39a75059935b041da7598730e7

SHA512
5b097fa139e74ff01d386bd3358c64457b3db85ae8017d377a4ae79ea577fdb78f941569f8e7eb68313195942f18720e126280d14c78c8e7bfaf5f3990dde52e

Download Submit
\Users\Admin\AppData\Local\Temp\fe8a5c03396ff557fa09f7d81636ce23d8b96b31d6a1f39fc49a29744895ef56.exe.dll
MD5
ca87e069969707b41a59e553cdc2ac44

SHA1
bac1c6a0adcfe79999749e25dbdc02f825cab5e6

SHA256
5f35bc6900ead503e6b04132f834a12ec15d2c39a75059935b041da7598730e7

SHA512
5b097fa139e74ff01d386bd3358c64457b3db85ae8017d377a4ae79ea577fdb78f941569f8e7eb68313195942f18720e126280d14c78c8e7bfaf5f3990dde52e

Download Submit
memory/3920-118-0x0000000000000000-mapping.dmp

Download
memory/3964-116-0x0000000000A30000-0x0000000000B2D000-memory.dmp

Filesize
1012KB

Download
memory/3964-115-0x0000000000940000-0x0000000000A25000-memory.dmp

Filesize
916KB

Download
memory/3964-117-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download