danabot | 4f93b05a243d6a948599fc8ff1ce43e798cad88f1882f14918f75410fda7819b

Analysis

max time kernel
70s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 05:27

Target

4f93b05a243d6a948599fc8ff1ce43e798cad88f1882f14918f75410fda7819b.exe
Size

1.2MB
MD5

d7bd349797b5965c05c7cb208821b3e5
SHA1

1abbcfe673bb47c2b1a82905c5f90ed421ad13c3
SHA256

4f93b05a243d6a948599fc8ff1ce43e798cad88f1882f14918f75410fda7819b
SHA512

a906373550d6e1817b46e0c615deef4bf66a2a5fc5959596791d945b4756f3a529d35a374864297a87cc42ac5ddb36c5946b50fd51a94b4f8b1218e50693dd67
SSDEEP

24576:TpLMncW+jn2uchvYDwhrXliJGGDBTXZQ9Y4czbHWjCGL9gr67Cb8c:I+j/sv2UDluGqZ6Y4czb6cn8c

Score

10^/10

Family

danabot

Attributes

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1076	1956	4f93b05a243d6a948599fc8ff1ce43e798cad88f1882f14918f75410fda7819b.exe	27
PID 1956 wrote to memory of 1076	1956	4f93b05a243d6a948599fc8ff1ce43e798cad88f1882f14918f75410fda7819b.exe	27
PID 1956 wrote to memory of 1076	1956	4f93b05a243d6a948599fc8ff1ce43e798cad88f1882f14918f75410fda7819b.exe	27
PID 1956 wrote to memory of 1076	1956	4f93b05a243d6a948599fc8ff1ce43e798cad88f1882f14918f75410fda7819b.exe	27

C:\Users\Admin\AppData\Local\Temp\4f93b05a243d6a948599fc8ff1ce43e798cad88f1882f14918f75410fda7819b.exe
"C:\Users\Admin\AppData\Local\Temp\4f93b05a243d6a948599fc8ff1ce43e798cad88f1882f14918f75410fda7819b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\AdapterTroubleshooter.exe
  C:\Windows\system32\AdapterTroubleshooter.exe
  2⤵
  PID:1076

memory/1076-56-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1956-54-0x0000000001FD0000-0x00000000020F2000-memory.dmp

Filesize
1.1MB

Download
memory/1956-57-0x0000000001FD0000-0x00000000020F2000-memory.dmp

Filesize
1.1MB

Download
memory/1956-58-0x0000000002100000-0x00000000023CE000-memory.dmp

Filesize
2.8MB

Download
memory/1956-59-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download
memory/1956-60-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download
memory/1956-62-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download