danabot | e14b5e3e0e463d43cc28fc76ef2c26b1ea0baecabfb2467241bd14d937ec4edd | Triage

Analysis

max time kernel
4294181s
max time network
123s
platform
windows7_x64
resource
win7-20220223-en
submitted
28-02-2022 10:24

Sharing

Report Analysis Logs

General

Target

a6b262fd9c0632265b09d7a0188c32d0e5042487368467e9e73ac0fbd3b56fae.dll
Size

1.3MB
MD5

69b5df6ca9fb51a4b225f3bf8e872a8e
SHA1

1d042cd3e47acddb39c98c16c7d669f629e9d159
SHA256

a6b262fd9c0632265b09d7a0188c32d0e5042487368467e9e73ac0fbd3b56fae
SHA512

7b6fc2d006e5ad47f5c6b4a7322258db4b28440a2e83eb004d51541c831269a071da14460e91786b36e89d73da1666c07130628b1887e3920ec28ba3d5cee59b

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.4:443

103.175.16.113:443

Attributes

embedded_hash
422236FD601D11EE82825A484D26DD6F
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2040-55-0x0000000000B50000-0x0000000000CA1000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2040 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1064 wrote to memory of 2040	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2040	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2040	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2040	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2040	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2040	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2040	1064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6b262fd9c0632265b09d7a0188c32d0e5042487368467e9e73ac0fbd3b56fae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6b262fd9c0632265b09d7a0188c32d0e5042487368467e9e73ac0fbd3b56fae.dll,#1
2⤵
- Blocklisted process makes network request
PID:2040

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-56-0x000007FEFB7A1000-0x000007FEFB7A3000-memory.dmp

Filesize
8KB

Download
memory/2040-54-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/2040-55-0x0000000000B50000-0x0000000000CA1000-memory.dmp

Filesize
1.3MB

Download