danabot | 7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da

Analysis

Target

7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe
Size

1.1MB
MD5

53bcf7fa7f6a41aab81d960598625d37
SHA1

7809c508e5ed2f8221afbfeb03a435a1686fa231
SHA256

7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da
SHA512

1f10efaa2f9d71c594286dc12dd3903e9c7dc2487357b9ffc4f3f9642fb02c80e7074659ecc9e4c48409de6d6cecc6d080546b75fa0e6c5575efab142fc2e01c

Score

10^/10

Family

danabot

Botnet

103.175.16.113:443

103.175.16.114:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1828 rundll32.exe

pid	process
1828	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe

description	pid	process	target process
PID 3812 wrote to memory of 1828	3812	7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe	rundll32.exe
PID 3812 wrote to memory of 1828	3812	7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe	rundll32.exe
PID 3812 wrote to memory of 1828	3812	7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe
"C:\Users\Admin\AppData\Local\Temp\7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe.dll,z C:\Users\Admin\AppData\Local\Temp\7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe
2⤵
- Loads dropped DLL
PID:1828

C:\Users\Admin\AppData\Local\Temp\7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe.dll
MD5
e1a1ecb97fe38d65ca7c50d65571ab51

SHA1
0b821247f7b2e63e5b79656ef4ce7fa0c23766b9

SHA256
7b24454b49d2d0b3910213c91ff8761eb3863856d2c24ad84016fb2e9fb32bce

SHA512
3e6a10d22651a3a96df8a2e5f864b83dedeb80ebb46b1cea044a9b163216e8bf4c2fe1871ddc31ee6c9df403482f68b892c57e8d57736cc641adddb890cc4bcf

Download Submit
\Users\Admin\AppData\Local\Temp\7508344c547d654937e4f1e51245488e562aaa12df42310bb9d1ecfbd08166da.exe.dll
MD5
e1a1ecb97fe38d65ca7c50d65571ab51

SHA1
0b821247f7b2e63e5b79656ef4ce7fa0c23766b9

SHA256
7b24454b49d2d0b3910213c91ff8761eb3863856d2c24ad84016fb2e9fb32bce

SHA512
3e6a10d22651a3a96df8a2e5f864b83dedeb80ebb46b1cea044a9b163216e8bf4c2fe1871ddc31ee6c9df403482f68b892c57e8d57736cc641adddb890cc4bcf

Download Submit
memory/1828-118-0x0000000000000000-mapping.dmp

Download
memory/3812-116-0x00000000009F0000-0x0000000000AED000-memory.dmp

Filesize
1012KB

Download
memory/3812-115-0x0000000000530000-0x000000000067A000-memory.dmp

Filesize
1.3MB

Download
memory/3812-117-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download