Analysis
- max time kernel
107s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
29/10/2021, 08:08
General
- Target e89bd687b7a33144bcbec0c467783439.dll
- Size 2.5MB
- Sample211029-j1l67shfdn
- SHA256 bb2e7b341aa7b7c75e148ca1b4eff2997626655e1d06329598d5a2c3be91f18a
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
185.158.250.216:443
-
194.76.225.46:443
-
45.11.180.153:443
-
194.76.225.61:443
Attributes
-
embedded_hash
AD14EA44261341E3690FA8CC1E236523
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 2 IoCs
- Blocklisted process makes network request 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e89bd687b7a33144bcbec0c467783439.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e89bd687b7a33144bcbec0c467783439.dll,#12⤵
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3860-116-0x00000000734A0000-0x000000007372E000-memory.dmp
memory/3860-118-0x00000000734A0000-0x000000007372E000-memory.dmp
memory/3860-117-0x00000000734A0000-0x0000000073603000-memory.dmp
memory/3860-120-0x0000000003120000-0x000000000326A000-memory.dmp