danabot | 66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14

Target

66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe
Size

1.1MB
MD5

b38799f3027e9f9802b601606109f8b1
SHA1

262cba4af397835d1e908fc4e438434d5cd63862
SHA256

66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14
SHA512

f88e2134d8694f8aefd14d3d67b2233e776c0b802af451227ec186b82bf20aff60bf07107997cac46409364ae0a979f6c7ca87a31c8df52199b62d9e9e5509eb

Score

10^/10

Malware Config

Family

danabot

Botnet

209.127.27.22:443

103.175.16.114:443

103.175.16.113:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021
C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll	DanabotLoader2021

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2148 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3220 3884 WerFault.exe 66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe

pid	process
2148	rundll32.exe

pid	pid_target	process	target process
3220	3884	WerFault.exe	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe

description	pid	process	target process
PID 3884 wrote to memory of 2148	3884	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 3884 wrote to memory of 2148	3884	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe
PID 3884 wrote to memory of 2148	3884	66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe
"C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3884

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll,z C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe
2⤵
- Loads dropped DLL
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 508
2⤵
- Program crash
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3884 -ip 3884
1⤵
PID:3988

C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
03eda6162be0a3c7d84ec4ff29276633

SHA1
9d671ee7effceae7a5c0ac0bc853eb6aadd57035

SHA256
ceb62307e7aac40e5fcefba1337cf70a6964dc6aac87201e8ca79823f1d7fe64

SHA512
8008805434631f0a4198956cd3a24c30408781fcc898911253ecb2909b67804a0421db4489b0f6cd7563cc9b4a626e3aaf78fd0d20e8333400a6112b246d281d

Download Submit
C:\Users\Admin\AppData\Local\Temp\66fe076625570981e87a7c0ad4e8d8111db959eda3d398a98c4a0f7fdb9a5a14.exe.dll
MD5
03eda6162be0a3c7d84ec4ff29276633

SHA1
9d671ee7effceae7a5c0ac0bc853eb6aadd57035

SHA256
ceb62307e7aac40e5fcefba1337cf70a6964dc6aac87201e8ca79823f1d7fe64

SHA512
8008805434631f0a4198956cd3a24c30408781fcc898911253ecb2909b67804a0421db4489b0f6cd7563cc9b4a626e3aaf78fd0d20e8333400a6112b246d281d

Download Submit
memory/3884-130-0x0000000000A7B000-0x0000000000B60000-memory.dmp

Filesize
916KB

Download
memory/3884-131-0x0000000000B70000-0x0000000000C6C000-memory.dmp

Filesize
1008KB

Download
memory/3884-132-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download