danabot | 89a79bf235fd3a402b5cdc29e58ce1a0e56ddf23f2cb2604b44ab1570e608fdd

Analysis

Target

89a79bf235fd3a402b5cdc29e58ce1a0e56ddf23f2cb2604b44ab1570e608fdd.dll
Size

1.9MB
MD5

6d9f899e26ce787bfa696e85583d49e1
SHA1

183496c077b1efdff28a1db820d461b5a4462c3c
SHA256

89a79bf235fd3a402b5cdc29e58ce1a0e56ddf23f2cb2604b44ab1570e608fdd
SHA512

dd7a7d45ee666f8fa7354e6633dc3ba209aec046dbc95991256c4ea832db1b75c2a8644b1f6538d3444a7b8a10103e551bc962721f590cb2e821374bd095ca6b

Score

10^/10

Family

danabot

185.117.90.36:443

193.42.36.59:443

193.56.146.53:443

185.106.123.228:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4092-120-0x0000000000400000-0x0000000000560000-memory.dmp	DanabotLoader2021
behavioral1/memory/4092-121-0x0000000000400000-0x00000000005F4000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

24 4092 rundll32.exe

flow	pid	process
24	4092	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4296 wrote to memory of 4092	4296	rundll32.exe	rundll32.exe
PID 4296 wrote to memory of 4092	4296	rundll32.exe	rundll32.exe
PID 4296 wrote to memory of 4092	4296	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89a79bf235fd3a402b5cdc29e58ce1a0e56ddf23f2cb2604b44ab1570e608fdd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89a79bf235fd3a402b5cdc29e58ce1a0e56ddf23f2cb2604b44ab1570e608fdd.dll,#1
2⤵
- Blocklisted process makes network request
PID:4092

memory/4092-118-0x0000000000000000-mapping.dmp

Download
memory/4092-119-0x0000000000400000-0x00000000005F4000-memory.dmp

Filesize
2.0MB

Download
memory/4092-120-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/4092-121-0x0000000000400000-0x00000000005F4000-memory.dmp

Filesize
2.0MB

Download
memory/4092-123-0x0000000000E80000-0x0000000000E81000-memory.dmp

Filesize
4KB

Download