danabot | 475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c

Analysis

Target

475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe
Size

1.1MB
MD5

6159a5ef88655d6e4637a9312156f34f
SHA1

67588821061bb96483c3954c89d8492ef0c833df
SHA256

475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c
SHA512

30c6ad45ed6cdf64acd6ef0045cf0bdcc1d0bb143fec6bba5181232ebdd6715215fef36c570df444d929896cc86a2e0f425407586d2b772d2e21708ad2403112

Score

10^/10

Family

danabot

Botnet

103.175.16.113:443

103.175.16.114:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe.dll	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1092 rundll32.exe

pid	process
1092	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe

description	pid	process	target process
PID 3796 wrote to memory of 1092	3796	475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe	rundll32.exe
PID 3796 wrote to memory of 1092	3796	475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe	rundll32.exe
PID 3796 wrote to memory of 1092	3796	475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe
"C:\Users\Admin\AppData\Local\Temp\475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe.dll,z C:\Users\Admin\AppData\Local\Temp\475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe
2⤵
- Loads dropped DLL
PID:1092

C:\Users\Admin\AppData\Local\Temp\475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe.dll
MD5
f9b6809cc9fde0622c7b1c529e81b420

SHA1
475856fe85dcfcb5233bb4d3d650bc65e5c5598d

SHA256
913f7bfd641c30dcb8ab0d21c478eeeb3b57c4b87417b2549139d36426c14520

SHA512
457248b56fd637d84fa09d9de590a9b10bda66eae26dba297246066b382d078b64785771272b823d200663998abc969399de7701876905c4a579086f4ae56f3a

Download Submit
\Users\Admin\AppData\Local\Temp\475c662f5abff998f6114d43d6a6054452c2fe488fe55441237c1723f0bb5d9c.exe.dll
MD5
f9b6809cc9fde0622c7b1c529e81b420

SHA1
475856fe85dcfcb5233bb4d3d650bc65e5c5598d

SHA256
913f7bfd641c30dcb8ab0d21c478eeeb3b57c4b87417b2549139d36426c14520

SHA512
457248b56fd637d84fa09d9de590a9b10bda66eae26dba297246066b382d078b64785771272b823d200663998abc969399de7701876905c4a579086f4ae56f3a

Download Submit
memory/1092-118-0x0000000000000000-mapping.dmp

Download
memory/3796-116-0x0000000000A70000-0x0000000000B6D000-memory.dmp

Filesize
1012KB

Download
memory/3796-115-0x0000000000980000-0x0000000000A65000-memory.dmp

Filesize
916KB

Download
memory/3796-117-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download