Analysis
- max time kernel
119s - max time network
134s - submitted
01/01/1970, 00:00
General
- Target 365835f25a48eec6e87a4c03377e67c2.dll
- Size 2.5MB
- Sample211027-r757nahbeq
- SHA256 2203d02a6aa593c823a8ad01a2b9fe25bd224832d04af253c7c1d0412d591756
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
185.158.250.216:443
-
194.76.225.46:443
-
45.11.180.153:443
-
194.76.225.61:443
Attributes
-
embedded_hash
AD14EA44261341E3690FA8CC1E236523
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 2 IoCs
- Blocklisted process makes network request 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\365835f25a48eec6e87a4c03377e67c2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\365835f25a48eec6e87a4c03377e67c2.dll,#12⤵
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3968-116-0x00000000737F0000-0x0000000073A7E000-memory.dmp
memory/3968-117-0x00000000032F0000-0x00000000032F1000-memory.dmp
memory/3968-118-0x00000000737F0000-0x0000000073953000-memory.dmp
memory/3968-119-0x00000000737F0000-0x0000000073A7E000-memory.dmp