danabot | 21f9c4c9a6873f9e0b106cf66196f36df8c1d9bcc263c36a52dc76436eabaa70

Analysis

Target

21f9c4c9a6873f9e0b106cf66196f36df8c1d9bcc263c36a52dc76436eabaa70.dll
Size

507KB
MD5

79baa6436ed9504491aef41aa6f27a71
SHA1

99a7bfe4263ae5c1b4db5dab6ded5a02843bb12a
SHA256

21f9c4c9a6873f9e0b106cf66196f36df8c1d9bcc263c36a52dc76436eabaa70
SHA512

c7e41359104fda345055f5ed0877da39334a62a598d2c97f38e846f25914afe1c8c0e542a97eba4ec3b9cf3d394bdbff0e0169b395e9a4da9e461cfbb0bdc452

Score

10^/10

Family

danabot

178.24.124.43

36.133.59.144

14.163.25.64

185.92.222.238

49.63.85.120

192.71.249.51

82.153.140.44

142.12.60.159

149.143.255.24

209.79.97.165

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4704 wrote to memory of 3756	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 3756	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 3756	4704	rundll32.exe	rundll32.exe
PID 3756 wrote to memory of 2096	3756	rundll32.exe	rundll32.exe
PID 3756 wrote to memory of 2096	3756	rundll32.exe	rundll32.exe
PID 3756 wrote to memory of 2096	3756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21f9c4c9a6873f9e0b106cf66196f36df8c1d9bcc263c36a52dc76436eabaa70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21f9c4c9a6873f9e0b106cf66196f36df8c1d9bcc263c36a52dc76436eabaa70.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3756

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\21f9c4c9a6873f9e0b106cf66196f36df8c1d9bcc263c36a52dc76436eabaa70.dll,f0
3⤵
- Blocklisted process makes network request
PID:2096

memory/2096-132-0x0000000000000000-mapping.dmp

Download
memory/3756-130-0x0000000000000000-mapping.dmp

Download
memory/3756-131-0x0000000000510000-0x000000000059C000-memory.dmp

Filesize
560KB

Download