danabot | 21a3c12fa181861883c4516221330d255674ae7378a7455bda0dcd3eb164f56e

Analysis

Target

0x000a000000003c9f-62.dll
Size

1.3MB
MD5

6b94162340dd76da03497c034c3a8ac4
SHA1

a7a7e32c62f1d8f2051e4d6932926d497abcc7cf
SHA256

21a3c12fa181861883c4516221330d255674ae7378a7455bda0dcd3eb164f56e
SHA512

9a59786d105fde33de629cd88b2d61c8d5b3baa2ee2a28388fb076ea00c26361e374029819512ea080eaeb044adb2666b66b66e301809e8d6676f41163289f64

Score

10^/10

Family

danabot

Botnet

142.11.206.50:443

192.236.161.79:443

192.236.146.39:443

37.220.31.27:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1476-131-0x00000000020C0000-0x000000000221F000-memory.dmp	DanabotLoader2021

suricata: ET MALWARE Danabot Key Exchange Request
suricata: ET MALWARE Danabot Key Exchange Request
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

3 1476 rundll32.exe

flow	pid	process
3	1476	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4236 wrote to memory of 1476	4236	rundll32.exe	rundll32.exe
PID 4236 wrote to memory of 1476	4236	rundll32.exe	rundll32.exe
PID 4236 wrote to memory of 1476	4236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0x000a000000003c9f-62.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0x000a000000003c9f-62.dll,#1
2⤵
- Blocklisted process makes network request
PID:1476

memory/1476-130-0x0000000000000000-mapping.dmp

Download
memory/1476-131-0x00000000020C0000-0x000000000221F000-memory.dmp

Filesize
1.4MB

Download