danabot | d094e3c39b39aa740f9e65da82a3c66710082de03a5b5ef27f8394cbf8e656a0

Analysis

max time kernel
119s
max time network
159s
platform
windows7_x64
resource
win7-en-20211014
submitted
12/11/2021, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5972705c192ed6e38fa09d73bd5ddd2d.dll
Size 1.9MB
Sample211112-l83j9sdbb4
SHA256 d094e3c39b39aa740f9e65da82a3c66710082de03a5b5ef27f8394cbf8e656a0
MD5 5972705c192ed6e38fa09d73bd5ddd2d
SHA1 8bd288aedc0418cadbfbe13c20aafe9f8c5a4ccf
SHA512 02de514288a4eaf01e4880f5a1c93a2e18e7ba8d6051ca601a51befecaa2634c5984881ec0c301b2ab60af715221f65bafad21f02e1e5f19e7f1500bd808fd8f
MD5 SHA1 SHA512

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443

Attributes

embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral1/memory/1724-60-0x0000000002080000-0x00000000021E0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1724-61-0x0000000002080000-0x0000000002274000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1724	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1724	1660	rundll32.exe	27
PID 1660 wrote to memory of 1724	1660	rundll32.exe	27
PID 1660 wrote to memory of 1724	1660	rundll32.exe	27
PID 1660 wrote to memory of 1724	1660	rundll32.exe	27
PID 1660 wrote to memory of 1724	1660	rundll32.exe	27
PID 1660 wrote to memory of 1724	1660	rundll32.exe	27
PID 1660 wrote to memory of 1724	1660	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5972705c192ed6e38fa09d73bd5ddd2d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5972705c192ed6e38fa09d73bd5ddd2d.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-56-0x00000000757E1000-0x00000000757E3000-memory.dmp

Download

memory/1724-57-0x0000000002080000-0x0000000002274000-memory.dmp

Download

memory/1724-59-0x0000000002080000-0x0000000002274000-memory.dmp

Download

memory/1724-60-0x0000000002080000-0x00000000021E0000-memory.dmp

Download

memory/1724-61-0x0000000002080000-0x0000000002274000-memory.dmp

Download

memory/1724-63-0x0000000000130000-0x0000000000131000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads