danabot | 117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757

Analysis

max time kernel
90s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2022 07:48

Target

117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe
Size

1.1MB
MD5

7daa0221894d61fcac662545eaa09629
SHA1

70bd1d9222b030c220ccc00c969afdeb32d61dba
SHA256

117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757
SHA512

11e5c32d9b88be211ed6fff30e65512259997cb3b65ce8f13f478f8f6e6d82a6b58ad7925eb9c0d5f8a2974e6bcfe2ca3b214c6b75094fb250d6266b2db3c40e
SSDEEP

24576:YXXSiy1vaKFhT+FCtZzomoagvnGhQvPT68B2MEBJ:wSiwaiyFYKmoTnG2PTtB293

Score

10^/10

Family

danabot

Botnet

192.119.110.244:443

108.170.20.90:443

142.11.206.50:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\117A69~1.TMP	DanabotLoader2021
C:\Users\Admin\AppData\Local\Temp\117A69~1.EXE.tmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

30 2012 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2012 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

520 2452 WerFault.exe 117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe

flow	pid	process
30	2012	rundll32.exe

pid	process
2012	rundll32.exe

pid	pid_target	process	target process
520	2452	WerFault.exe	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe

description	pid	process	target process
PID 2452 wrote to memory of 2012	2452	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe
PID 2452 wrote to memory of 2012	2452	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe
PID 2452 wrote to memory of 2012	2452	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe
"C:\Users\Admin\AppData\Local\Temp\117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 536
2⤵
- Program crash
PID:520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2452 -ip 2452
1⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\117A69~1.EXE.tmp
Filesize
1.3MB

MD5
23408d130fc2b6f239aaf8f2335fd64d

SHA1
4f6a19f9491b56ba232193e8acab239e6b667db2

SHA256
e5b167ddb2915ba025b940d4ba8efafedb651bcb7d94e720c60a53344afa234e

SHA512
7d7c5f10e14c8d0803da9cf41ca8ad0b33df64e7886316d30067e067145572141d0df8d3b9335d481836de61f40f6e6c9527fdaf3e3333fc84c1bd240f8a90a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\117A69~1.TMP
Filesize
1.3MB

MD5
23408d130fc2b6f239aaf8f2335fd64d

SHA1
4f6a19f9491b56ba232193e8acab239e6b667db2

SHA256
e5b167ddb2915ba025b940d4ba8efafedb651bcb7d94e720c60a53344afa234e

SHA512
7d7c5f10e14c8d0803da9cf41ca8ad0b33df64e7886316d30067e067145572141d0df8d3b9335d481836de61f40f6e6c9527fdaf3e3333fc84c1bd240f8a90a0

Download Submit
memory/2012-132-0x0000000000000000-mapping.dmp

Download
memory/2452-135-0x00000000027E0000-0x00000000028CA000-memory.dmp

Filesize
936KB

Download
memory/2452-136-0x0000000002980000-0x0000000002A80000-memory.dmp

Filesize
1024KB

Download
memory/2452-137-0x0000000000400000-0x0000000000A8A000-memory.dmp

Filesize
6.5MB

Download