danabot | 117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757

Analysis

max time kernel
67s
max time network
81s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 07:48

Target

117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe
Size

1.1MB
MD5

7daa0221894d61fcac662545eaa09629
SHA1

70bd1d9222b030c220ccc00c969afdeb32d61dba
SHA256

117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757
SHA512

11e5c32d9b88be211ed6fff30e65512259997cb3b65ce8f13f478f8f6e6d82a6b58ad7925eb9c0d5f8a2974e6bcfe2ca3b214c6b75094fb250d6266b2db3c40e
SSDEEP

24576:YXXSiy1vaKFhT+FCtZzomoagvnGhQvPT68B2MEBJ:wSiwaiyFYKmoTnG2PTtB293

Score

10^/10

Family

danabot

Botnet

192.119.110.244:443

108.170.20.90:443

142.11.206.50:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\117A69~1.TMP	DanabotLoader2021
behavioral1/memory/1788-62-0x0000000000AB0000-0x0000000000C0E000-memory.dmp	DanabotLoader2021
\Users\Admin\AppData\Local\Temp\117A69~1.TMP	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1788 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1788 rundll32.exe

flow	pid	process
2	1788	rundll32.exe

pid	process
1788	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe

description	pid	process	target process
PID 288 wrote to memory of 1788	288	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe
PID 288 wrote to memory of 1788	288	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe
PID 288 wrote to memory of 1788	288	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe
PID 288 wrote to memory of 1788	288	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe
PID 288 wrote to memory of 1788	288	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe
PID 288 wrote to memory of 1788	288	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe
PID 288 wrote to memory of 1788	288	117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe
"C:\Users\Admin\AppData\Local\Temp\117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Users\Admin\AppData\Local\Temp\117A69~1.TMP
Filesize
1.3MB

MD5
23408d130fc2b6f239aaf8f2335fd64d

SHA1
4f6a19f9491b56ba232193e8acab239e6b667db2

SHA256
e5b167ddb2915ba025b940d4ba8efafedb651bcb7d94e720c60a53344afa234e

SHA512
7d7c5f10e14c8d0803da9cf41ca8ad0b33df64e7886316d30067e067145572141d0df8d3b9335d481836de61f40f6e6c9527fdaf3e3333fc84c1bd240f8a90a0

Download Submit
\Users\Admin\AppData\Local\Temp\117A69~1.TMP
Filesize
1.3MB

MD5
23408d130fc2b6f239aaf8f2335fd64d

SHA1
4f6a19f9491b56ba232193e8acab239e6b667db2

SHA256
e5b167ddb2915ba025b940d4ba8efafedb651bcb7d94e720c60a53344afa234e

SHA512
7d7c5f10e14c8d0803da9cf41ca8ad0b33df64e7886316d30067e067145572141d0df8d3b9335d481836de61f40f6e6c9527fdaf3e3333fc84c1bd240f8a90a0

Download Submit
memory/288-54-0x0000000000C40000-0x0000000000D2A000-memory.dmp

Filesize
936KB

Download
memory/288-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/288-57-0x0000000000C40000-0x0000000000D2A000-memory.dmp

Filesize
936KB

Download
memory/288-59-0x00000000024C0000-0x00000000025C0000-memory.dmp

Filesize
1024KB

Download
memory/288-63-0x0000000000400000-0x0000000000A8A000-memory.dmp

Filesize
6.5MB

Download
memory/1788-56-0x0000000000000000-mapping.dmp

Download
memory/1788-62-0x0000000000AB0000-0x0000000000C0E000-memory.dmp

Filesize
1.4MB

Download