danabot | 4642a926e0bf60e4e996601244c3bfcf397f213cc08fdfd90e64795f5f5ede0e

Analysis

Target

4642a926e0bf60e4e996601244c3bfcf397f213cc08fdfd90e64795f5f5ede0e.dll
Size

1.9MB
MD5

53ae8c388fe67beda5e87110993bf101
SHA1

2156f07b6674888c4164fa2316fdcbe7f0455a20
SHA256

4642a926e0bf60e4e996601244c3bfcf397f213cc08fdfd90e64795f5f5ede0e
SHA512

1a3d019a7fc41510a8305651573d50bf41bd990071568dec372c5004cd65b149e51bccbdda1aa68fdd37a97074798996296d270ba8eecc6acd599d8df4847f1a

Score

10^/10

Family

danabot

185.117.90.36:443

193.42.36.59:443

193.56.146.53:443

185.106.123.228:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2176-118-0x0000000000400000-0x0000000000560000-memory.dmp	DanabotLoader2021
behavioral1/memory/2176-119-0x0000000000400000-0x00000000005F4000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

22 2176 rundll32.exe

flow	pid	process
22	2176	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2976 wrote to memory of 2176	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2176	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2176	2976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4642a926e0bf60e4e996601244c3bfcf397f213cc08fdfd90e64795f5f5ede0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4642a926e0bf60e4e996601244c3bfcf397f213cc08fdfd90e64795f5f5ede0e.dll,#1
2⤵
- Blocklisted process makes network request
PID:2176

memory/2176-115-0x0000000000000000-mapping.dmp

Download
memory/2176-116-0x0000000000400000-0x00000000005F4000-memory.dmp

Filesize
2.0MB

Download
memory/2176-117-0x0000000001000000-0x00000000010AE000-memory.dmp

Filesize
696KB

Download
memory/2176-118-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/2176-119-0x0000000000400000-0x00000000005F4000-memory.dmp

Filesize
2.0MB

Download