danabot | 2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2022 14:31

Target

2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe
Size

3.6MB
MD5

41fe97773c2e2d8600d771510f4c0d00
SHA1

642d9feb83d6afaa6b5f455f617914beedd67556
SHA256

2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9
SHA512

bbc823c37970e45e05ad9a507416b70f21d75caab2420da04171846fef1f04b71c5ad41c9234f3ee9fd1965e48c80846d37ec70f8b0f965c52bf0160d12abb47
SSDEEP

49152:zjvWrU4VyUHA3iRYoySMbSsigAh14tKS2lw4I0LGAEfxQGV3O:3wU4VyUHpRYoESsigAly4

Score

10^/10

Family

danabot

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2612 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3276 4156 WerFault.exe 2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe

pid	process
2612	rundll32.exe

pid	pid_target	process	target process
3276	4156	WerFault.exe	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe

description	pid	process	target process
PID 4156 wrote to memory of 2612	4156	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe
PID 4156 wrote to memory of 2612	4156	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe
PID 4156 wrote to memory of 2612	4156	2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe
"C:\Users\Admin\AppData\Local\Temp\2346e9b8dce669925fef36a5258ae2b3ea5840f21a94bff1999fb77212f04fc9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4156

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start
2⤵
- Loads dropped DLL
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 672
2⤵
- Program crash
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4156 -ip 4156
1⤵
PID:4764

C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
240cc8dcae3db6fa9de0160c9107d26c

SHA1
3f3cb2c95e0f0e259543c0ed4295e4086e1c5685

SHA256
cd537d0bcf60072cc350aefc344397d7dcaf507d608b7afe8510b035892ca7f3

SHA512
6dc3840b9a7038c8787743d8e0437e0aebf41ee04138806006b372c03529ffce524c4b2541110debb54cb9ba1b9f1246d5ea5f3d60d1d91e6ad7965e50c03db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
240cc8dcae3db6fa9de0160c9107d26c

SHA1
3f3cb2c95e0f0e259543c0ed4295e4086e1c5685

SHA256
cd537d0bcf60072cc350aefc344397d7dcaf507d608b7afe8510b035892ca7f3

SHA512
6dc3840b9a7038c8787743d8e0437e0aebf41ee04138806006b372c03529ffce524c4b2541110debb54cb9ba1b9f1246d5ea5f3d60d1d91e6ad7965e50c03db6

Download Submit
memory/2612-132-0x0000000000000000-mapping.dmp

Download
memory/2612-135-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/2612-136-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download