danabot | 28e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb

General

Target

28e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb.exe
Size

1.3MB
MD5

38ba7056d233e336378d7d0f9228c9c4
SHA1

8ef3721c27c92928292af285b0e3f9a36e70668b
SHA256

28e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb
SHA512

2d95800224280634ccee934d91bdb2d307e39c794b10151b1caa8712f0c1cac12741d34e17fe8d2abf3706f0250e29b1f5f299cd59d3e64cb927ae534fffb508
SSDEEP

24576:x4pqX//Rdl1pbeYuv3ONAAYPcBIxVUB4eXOzYqMYP/FEQFVjnxEQ1FEj:DXbl1NelvTjPfUOk52WCJnxZ

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

28e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb.exe

description	pid	process	target process
PID 3520 wrote to memory of 3584	3520	28e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb.exe	appidtel.exe
PID 3520 wrote to memory of 3584	3520	28e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb.exe	appidtel.exe
PID 3520 wrote to memory of 3584	3520	28e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb.exe	appidtel.exe

C:\Users\Admin\AppData\Local\Temp\28e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb.exe
"C:\Users\Admin\AppData\Local\Temp\28e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3520

C:\Windows\SysWOW64\appidtel.exe
C:\Windows\system32\appidtel.exe
2⤵
PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-140-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-121-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-117-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-120-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-143-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-122-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-123-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-124-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-125-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-126-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-127-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-128-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-129-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-130-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-131-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-144-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-134-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-135-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-136-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-137-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-138-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-139-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-141-0x0000000002400000-0x0000000002530000-memory.dmp

Filesize
1.2MB

Download
memory/3520-142-0x0000000002580000-0x000000000285B000-memory.dmp

Filesize
2.9MB

Download
memory/3520-119-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-118-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-133-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-145-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-146-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-147-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-148-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3520-160-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/3520-162-0x0000000002400000-0x0000000002530000-memory.dmp

Filesize
1.2MB

Download
memory/3520-163-0x0000000002580000-0x000000000285B000-memory.dmp

Filesize
2.9MB

Download
memory/3520-164-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/3520-165-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/3520-167-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/3520-166-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/3584-151-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-152-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-153-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-154-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-155-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-156-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-150-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-149-0x0000000000000000-mapping.dmp

Download
memory/3584-157-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-159-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-161-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-158-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads