danabot | 251f0367a0af27d06454748f0570227b5ecd705f0ff0b40cfa6a75517d099423

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 13:46

Target

251F0367A0AF27D06454748F0570227B5ECD705F0FF0B.dll
Size

1.3MB
MD5

68d02c1a01d60c7cdbdf9125bdd0f0cf
SHA1

7520a2d9d572ea41e83115eba2495936f21cb4e5
SHA256

251f0367a0af27d06454748f0570227b5ecd705f0ff0b40cfa6a75517d099423
SHA512

78263097188299d1961a8658398f6edd0b0a69f6cdc862a2b0868d4505f28cec090aa499eaeb6ebdc2126b151cd6a06396238fb0e8d0723d4ba2a5b7178152aa
SSDEEP

24576:R8FPipdRl4oQ5Z8tkd8WVApcZPyJuPh+OGTSN1m:S+6mqtygNGTUI

Score

10^/10

Family

danabot

Botnet

185.243.114.28:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1708-56-0x00000000006A0000-0x00000000007FD000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

1 1708 rundll32.exe

flow	pid	process
1	1708	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 620 wrote to memory of 1708	620	rundll32.exe	rundll32.exe
PID 620 wrote to memory of 1708	620	rundll32.exe	rundll32.exe
PID 620 wrote to memory of 1708	620	rundll32.exe	rundll32.exe
PID 620 wrote to memory of 1708	620	rundll32.exe	rundll32.exe
PID 620 wrote to memory of 1708	620	rundll32.exe	rundll32.exe
PID 620 wrote to memory of 1708	620	rundll32.exe	rundll32.exe
PID 620 wrote to memory of 1708	620	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\251F0367A0AF27D06454748F0570227B5ECD705F0FF0B.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\251F0367A0AF27D06454748F0570227B5ECD705F0FF0B.dll,#1
2⤵
- Blocklisted process makes network request
PID:1708

memory/1708-54-0x0000000000000000-mapping.dmp

Download
memory/1708-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x00000000006A0000-0x00000000007FD000-memory.dmp

Filesize
1.4MB

Download