danabot | 6c4eb7846f442cc3f3db48fe0d016e5adc7c6639434eb5d83f06583eb43257be

Analysis

Target

6c4eb7846f442cc3f3db48fe0d016e5adc7c6639434eb5d83f06583eb43257be.dll
Size

1.9MB
MD5

61de01016846d49f1eaf0635dada0148
SHA1

d71af7c334554306f5670d654916f426773f1f7d
SHA256

6c4eb7846f442cc3f3db48fe0d016e5adc7c6639434eb5d83f06583eb43257be
SHA512

09eeda67f04e4fbb62fa9b7397c747e1024c8cddcb918e6fea55a20e97b3d4e6e515983546d0d6895a2fabe1d8a98edcb98248bdde2ac09269ce2f8115c52960

Score

10^/10

Family

danabot

185.117.90.36:443

193.42.36.59:443

193.56.146.53:443

185.106.123.228:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2700-121-0x0000000000400000-0x00000000005F4000-memory.dmp	DanabotLoader2021
behavioral1/memory/2700-120-0x0000000000400000-0x0000000000560000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

22 2700 rundll32.exe

flow	pid	process
22	2700	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2668 wrote to memory of 2700	2668	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 2700	2668	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 2700	2668	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c4eb7846f442cc3f3db48fe0d016e5adc7c6639434eb5d83f06583eb43257be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c4eb7846f442cc3f3db48fe0d016e5adc7c6639434eb5d83f06583eb43257be.dll,#1
2⤵
- Blocklisted process makes network request
PID:2700

memory/2700-118-0x0000000000000000-mapping.dmp

Download
memory/2700-119-0x0000000000400000-0x00000000005F4000-memory.dmp

Filesize
2.0MB

Download
memory/2700-121-0x0000000000400000-0x00000000005F4000-memory.dmp

Filesize
2.0MB

Download
memory/2700-120-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/2700-123-0x0000000002DA0000-0x0000000002EEA000-memory.dmp

Filesize
1.3MB

Download