File name:

99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e

Full analysis: https://app.any.run/tasks/cb02409c-8389-4255-80a9-9d1e38288a9d
Verdict: Malicious activity
Threats:

Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild, this is one of the most advanced thanks to the modular design and a complex delivery method.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 02:58:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
danabot
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

18E0D922BEAD757AF754E54CC744EAA0

SHA1:

22A03FBC28E0DADF13E1ACE67109B1DC3E91D0F5

SHA256:

99DB2E72873B64451CBFB76B8402964EEA1B84CF0FE9E326507673D5A534C04E

SSDEEP:

49152:6ATTetUw+nmIhWifsBIIX8I+axfMJqv4LTQNzXLA8PR+f4Y8aeLBaOufaAuWq/Zi:6AToF+mIlkSg8halMJqgT+XL3QJYBaOO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DANABOT has been detected (YARA)

      • rundll32.exe (PID: 1276)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe (PID: 1300)

    • Executes application which crashes

      • 99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe (PID: 1300)

    • There is functionality for taking screenshot (YARA)

      • rundll32.exe (PID: 1276)

  • INFO

    • Checks supported languages

      • 99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe (PID: 1300)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6516)

    • Reads the machine GUID from the registry

      • 99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe (PID: 1300)

    • Create files in a temporary directory

      • 99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe (PID: 1300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (44.9)
.exe | Win64 Executable (generic) (39.8)
.exe | Win32 Executable (generic) (6.4)
.exe | Clipper DOS Executable (2.9)
.exe | Generic Win/DOS Executable (2.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:03:24 15:49:24+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 1003520
InitializedDataSize: 42653696
UninitializedDataSize: -
EntryPoint: 0x21cd
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 12.0.0.0
ProductVersionNumber: 59.0.0.0
FileFlagsMask: 0x058f
FileFlags: Private build, Info inferred
FileOS: Unknown (0x60324)
ObjectFileType: Static library
FileSubtype: 86
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe #DANABOT rundll32.exe no specs werfault.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1276C:\WINDOWS\system32\rundll32.exe C:\Users\admin\AppData\Local\Temp\99DB2E~1.TMP,S C:\Users\admin\AppData\Local\Temp\99DB2E~1.EXEC:\Windows\SysWOW64\rundll32.exe
99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1300"C:\Users\admin\AppData\Local\Temp\99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe" C:\Users\admin\AppData\Local\Temp\99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4812C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5960"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6516C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1300 -s 512C:\Windows\SysWOW64\WerFault.exe—99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
2 007
Read events
2 007
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6516WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_99db2e72873b6445_fc61b625916ad5fbaec1d088701cb4b645f99437_b77754cc_fdb6dba8-6bb8-4c37-a09f-da31002cbac9\Report.wer —
MD5:—
SHA256:—
6516WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD10D.tmp.dmpbinary
MD5:95A94DF4450012A8E0EDC49CE6C10530
SHA256:DA038B800C0DA6DDFF4DC313DF03FBA061FD0092B52A9D4E6D55A8B726C57215
130099db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exeC:\Users\admin\AppData\Local\Temp\99DB2E~1.EXE.tmpexecutable
MD5:8B27AB375B85BA2516670F5B9FF1E91E
SHA256:FCE6FF1FA9C69C14FD3566E7AA9CEC99C26C57313C5CA3DC0594319F0E720788
6516WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD229.tmp.xmlxml
MD5:19EE83042407B470BF5366448B4FB92A
SHA256:DB07FD25F7456C05331F231C754B7048477DFD26B052486FF8F92FB0B9F6FFA3
6516WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe.1300.dmpbinary
MD5:6DD78891517D1A40DA914E8250BA1F65
SHA256:3E69EE00E70F46E254E37C2FF67F348E258BEC71AB0560C0B4E6FEF4E3FB2358
6516WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D9.tmp.WERInternalMetadata.xmlbinary
MD5:6A972B39C2144B9D1BBA9A1A15C08E69
SHA256:4385F4CFA7964C2E67868C460000AC71265781CA6C66ECE7CC957BCFCBC1A0A7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1228
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.130
  • 40.126.31.0
  • 40.126.31.3
  • 40.126.31.67
  • 20.190.159.23
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e