danabot | d09dd239bdce103c46540970a7047a5419c9cc7b75759a18b6219ba71efe05e0

General

Target

d09dd239bdce103c46540970a7047a5419c9cc7b75759a18b6219ba71efe05e0.exe
Size

1.3MB
MD5

f4d84eb34cdbd8b51173f50ae9302556
SHA1

cf03ff45dae92c973774b5a2bc937bdd29fa9a95
SHA256

d09dd239bdce103c46540970a7047a5419c9cc7b75759a18b6219ba71efe05e0
SHA512

63e9fb940c2b0d6a92bc1ad3213074fa412643948038fbed1d0c09fc5f1f1a79b010632c55e84bcc6b5fe1fffeb6d0884535b0612a20012a10c16c03c48df7da
SSDEEP

24576:qR+qb5iGrdmcSBPtcMP5O1+DG3Pvh7p+ZhHlifT0Au1CTbci:ub5iEdtSJtY1+KtYBAu0nL

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d09dd239bdce103c46540970a7047a5419c9cc7b75759a18b6219ba71efe05e0.exe

description	pid	process	target process
PID 4808 wrote to memory of 4184	4808	d09dd239bdce103c46540970a7047a5419c9cc7b75759a18b6219ba71efe05e0.exe	appidtel.exe
PID 4808 wrote to memory of 4184	4808	d09dd239bdce103c46540970a7047a5419c9cc7b75759a18b6219ba71efe05e0.exe	appidtel.exe
PID 4808 wrote to memory of 4184	4808	d09dd239bdce103c46540970a7047a5419c9cc7b75759a18b6219ba71efe05e0.exe	appidtel.exe

C:\Users\Admin\AppData\Local\Temp\d09dd239bdce103c46540970a7047a5419c9cc7b75759a18b6219ba71efe05e0.exe
"C:\Users\Admin\AppData\Local\Temp\d09dd239bdce103c46540970a7047a5419c9cc7b75759a18b6219ba71efe05e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\appidtel.exe
C:\Windows\system32\appidtel.exe
2⤵
PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4184-152-0x0000000000000000-mapping.dmp

Download
memory/4184-164-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-163-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-162-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-160-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-161-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-159-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-157-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-156-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-155-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-154-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4184-153-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-132-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-120-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-134-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-136-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-137-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-138-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-139-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-140-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-142-0x00000000024F0000-0x0000000002626000-memory.dmp

Filesize
1.2MB

Download
memory/4808-143-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-144-0x0000000002630000-0x000000000290B000-memory.dmp

Filesize
2.9MB

Download
memory/4808-141-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-145-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-146-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-147-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-148-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-149-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-150-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-151-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-133-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-131-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-130-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-129-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-128-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-127-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-158-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/4808-126-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-125-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-124-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-123-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-122-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-121-0x0000000077340000-0x00000000774CE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-165-0x00000000024F0000-0x0000000002626000-memory.dmp

Filesize
1.2MB

Download
memory/4808-166-0x0000000002630000-0x000000000290B000-memory.dmp

Filesize
2.9MB

Download
memory/4808-167-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/4808-168-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/4808-169-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/4808-170-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads