File name:

5db4153d9523b8773529bd898a6deac0.exe

Full analysis: https://app.any.run/tasks/46f270f5-bb8a-48c5-9d65-73d558b6b1b4
Verdict: Malicious activity
Threats:

Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild, this is one of the most advanced thanks to the modular design and a complex delivery method.

Malware Trends Tracker     >>>
Analysis date: February 14, 2025, 20:55:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
danabot
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

5DB4153D9523B8773529BD898A6DEAC0

SHA1:

60572C719979B06664AE2FEB8595DB2D7A6F18ED

SHA256:

4F66BCA89E4BEB33758A46FB192B744779052B2E5E2E96E2B41D2FD093F61074

SSDEEP:

98304:G/9ADTpciOHuf5eL52YthN/OCrUlGWQk7ohv1LNSOEyBqctniR4tbVTeo7kpkbk3:rQPZ2gbRMvhQdWAF8Fg2Qs/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DANABOT has been detected (SURICATA)

      • explorer.exe (PID: 6660)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 5892)
      • WinX_DVD_Ripper_Platinum.exe (PID: 3288)
      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 3188)

    • Starts itself from another location

      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 3188)
      • WinX_DVD_Ripper_Platinum.exe (PID: 3288)

    • Process drops legitimate windows executable

      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 5892)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 6660)

    • Starts CMD.EXE for commands execution

      • WinX_DVD_Ripper_Platinum.exe (PID: 4684)

  • INFO

    • Checks supported languages

      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 3188)
      • WinX_DVD_Ripper_Platinum.exe (PID: 3288)
      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 5892)
      • WinX_DVD_Ripper_Platinum.exe (PID: 4684)

    • The sample compiled with english language support

      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 3188)
      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 5892)
      • WinX_DVD_Ripper_Platinum.exe (PID: 3288)

    • Create files in a temporary directory

      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 3188)
      • 5db4153d9523b8773529bd898a6deac0.exe (PID: 5892)
      • WinX_DVD_Ripper_Platinum.exe (PID: 4684)

    • Reads the computer name

      • WinX_DVD_Ripper_Platinum.exe (PID: 3288)
      • WinX_DVD_Ripper_Platinum.exe (PID: 4684)

    • Creates files or folders in the user directory

      • WinX_DVD_Ripper_Platinum.exe (PID: 3288)

    • Reads Windows Product ID

      • explorer.exe (PID: 6660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:04:05 13:00:43+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.34
CodeSize: 442880
InitializedDataSize: 237568
UninitializedDataSize: -
EntryPoint: 0x46a50
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.0.3.0
ProductVersionNumber: 0.0.3.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Benzene
FileDescription: Art
FileVersion: 0.0.3.0
InternalName: burn
OriginalFileName: libertine.exe
ProductName: Art
ProductVersion: 0.0.3.0
LegalCopyright: Copyright (c) Benzene. All rights reserved.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
7
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 5db4153d9523b8773529bd898a6deac0.exe 5db4153d9523b8773529bd898a6deac0.exe winx_dvd_ripper_platinum.exe winx_dvd_ripper_platinum.exe no specs cmd.exe no specs conhost.exe no specs #DANABOT explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
3188"C:\Users\admin\AppData\Local\Temp\5db4153d9523b8773529bd898a6deac0.exe" C:\Users\admin\AppData\Local\Temp\5db4153d9523b8773529bd898a6deac0.exe
explorer.exe
User:
admin
Company:
Benzene
Integrity Level:
MEDIUM
Description:
Art
Exit code:
0
Version:
0.0.3.0
Modules
Images
c:\users\admin\appdata\local\temp\5db4153d9523b8773529bd898a6deac0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3288C:\Users\admin\AppData\Local\Temp\{50A55A14-1D73-473E-B963-FC2C495B8FB0}\.ba\WinX_DVD_Ripper_Platinum.exeC:\Users\admin\AppData\Local\Temp\{50A55A14-1D73-473E-B963-FC2C495B8FB0}\.ba\WinX_DVD_Ripper_Platinum.exe
5db4153d9523b8773529bd898a6deac0.exe
User:
admin
Company:
Digiarty Software, Inc.
Integrity Level:
MEDIUM
Description:
WinX DVD Ripper Platinum
Exit code:
0
Version:
8.22.0.246
Modules
Images
c:\users\admin\appdata\local\temp\{50a55a14-1d73-473e-b963-fc2c495b8fb0}\.ba\winx_dvd_ripper_platinum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4684C:\Users\admin\AppData\Roaming\cloudvalid_debug_v2\WinX_DVD_Ripper_Platinum.exeC:\Users\admin\AppData\Roaming\cloudvalid_debug_v2\WinX_DVD_Ripper_Platinum.exe—WinX_DVD_Ripper_Platinum.exe
User:
admin
Company:
Digiarty Software, Inc.
Integrity Level:
MEDIUM
Description:
WinX DVD Ripper Platinum
Exit code:
1
Version:
8.22.0.246
Modules
Images
c:\users\admin\appdata\roaming\cloudvalid_debug_v2\winx_dvd_ripper_platinum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4824\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5892"C:\Users\admin\AppData\Local\Temp\{0AA0D63A-5802-435D-B9DF-BE195C82F12E}\.cr\5db4153d9523b8773529bd898a6deac0.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\5db4153d9523b8773529bd898a6deac0.exe" -burn.filehandle.attached=656 -burn.filehandle.self=624C:\Users\admin\AppData\Local\Temp\{0AA0D63A-5802-435D-B9DF-BE195C82F12E}\.cr\5db4153d9523b8773529bd898a6deac0.exe
5db4153d9523b8773529bd898a6deac0.exe
User:
admin
Company:
Benzene
Integrity Level:
MEDIUM
Description:
Art
Exit code:
0
Version:
0.0.3.0
Modules
Images
c:\users\admin\appdata\local\temp\{0aa0d63a-5802-435d-b9df-be195c82f12e}\.cr\5db4153d9523b8773529bd898a6deac0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5992C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe—WinX_DVD_Ripper_Platinum.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6660C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ecicjqctvjm
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
2 035
Read events
2 035
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
58925db4153d9523b8773529bd898a6deac0.exeC:\Users\admin\AppData\Local\Temp\{50A55A14-1D73-473E-B963-FC2C495B8FB0}\.ba\moidore.yml —
MD5:—
SHA256:—
3288WinX_DVD_Ripper_Platinum.exeC:\Users\admin\AppData\Roaming\cloudvalid_debug_v2\moidore.yml —
MD5:—
SHA256:—
4684WinX_DVD_Ripper_Platinum.exeC:\Users\admin\AppData\Local\Temp\ee4d08a —
MD5:—
SHA256:—
5992cmd.exeC:\Users\admin\AppData\Local\Temp\ecicjqctvjm —
MD5:—
SHA256:—
31885db4153d9523b8773529bd898a6deac0.exeC:\Users\admin\AppData\Local\Temp\{0AA0D63A-5802-435D-B9DF-BE195C82F12E}\.cr\5db4153d9523b8773529bd898a6deac0.exeexecutable
MD5:231C0121CB6F755093C02A9BB2B8D772
SHA256:C1CC37B7D07AD549FCCDEC372787F0BC7EB63081E62D74D85B2B26729BF8646D
58925db4153d9523b8773529bd898a6deac0.exeC:\Users\admin\AppData\Local\Temp\{50A55A14-1D73-473E-B963-FC2C495B8FB0}\.ba\BundleExtensionData.xmlxml
MD5:A35990570AFAA7D023FD2EBBE229AFB8
SHA256:9B696AD0EC3B37BAC11DA76BCD51AD907D31EE9638DAD7BB8FDD5AEF919EF621
58925db4153d9523b8773529bd898a6deac0.exeC:\Users\admin\AppData\Local\Temp\{50A55A14-1D73-473E-B963-FC2C495B8FB0}\.ba\libeay32.dllexecutable
MD5:73A8CDC0BB5B95C1BA6DEB39D71F0349
SHA256:639980C48DD692E9FF3144F3D932AA07E501F12197D587EC47EB5EC8F6B7696A
58925db4153d9523b8773529bd898a6deac0.exeC:\Users\admin\AppData\Local\Temp\{50A55A14-1D73-473E-B963-FC2C495B8FB0}\.ba\Sect.dllexecutable
MD5:B926B3D5048B94183703D58F7FDDA907
SHA256:AF60637BB1ED0AE00FCBFAE2AFA81C60AEAFE022E859A0F14A79718D6BF37A69
58925db4153d9523b8773529bd898a6deac0.exeC:\Users\admin\AppData\Local\Temp\{50A55A14-1D73-473E-B963-FC2C495B8FB0}\.ba\WinX_DVD_Ripper_Platinum.exeexecutable
MD5:3C64548B4AEDBD79411D69029BDAE67F
SHA256:1F7A9CF0F11E5D30538E7162AA69C9216839DDA3928B25368434F7E6E96EA0FB
58925db4153d9523b8773529bd898a6deac0.exeC:\Users\admin\AppData\Local\Temp\{50A55A14-1D73-473E-B963-FC2C495B8FB0}\.ba\profile.dllexecutable
MD5:4412C0FC5C89BFA65AF7CB86751EF37B
SHA256:19541810EF0262999D9E28F0278A79E3A84B6386D13D3E4091665C28DBEB2768
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
38
DNS requests
19
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.67.160.244:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6668
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6668
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2092
backgroundTaskHost.exe
GET
200
23.67.160.244:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
3576
svchost.exe
GET
200
23.48.23.140:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
23.67.160.244:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3576
svchost.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3700
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3576
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
23.212.110.138:443
www.bing.com
Akamai International B.V.
CZ
whitelisted
—
—
23.67.160.244:80
ocsp.digicert.com
AKAMAI-AS
JP
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
23.67.160.244:80
ocsp.digicert.com
AKAMAI-AS
JP
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
  • 4.231.128.59
whitelisted
www.bing.com
  • 23.212.110.138
  • 23.212.110.161
  • 23.212.110.208
  • 23.212.110.218
  • 23.212.110.137
  • 23.212.110.168
  • 23.212.110.178
  • 23.212.110.217
  • 23.212.110.136
whitelisted
google.com
  • 142.250.185.142
whitelisted
ocsp.digicert.com
  • 23.67.160.244
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.23
  • 40.126.31.73
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.131
  • 40.126.31.67
  • 40.126.31.3
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
crl.microsoft.com
  • 23.48.23.140
  • 23.48.23.143
  • 23.48.23.144
  • 23.48.23.155
  • 23.48.23.139
  • 23.48.23.153
  • 23.48.23.145
  • 23.48.23.137
  • 23.48.23.134
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
6660
explorer.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Danabot TCP Packet
6660
explorer.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Danabot TCP Packet
6660
explorer.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Danabot TCP Packet
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Danabot TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
5db4153d9523b8773529bd898a6deac0.exe