danabot | 454f76ecaea8080ab5a9216ba319db0a58b015ed6497be6ac55b3b770236c43c

Analysis

max time kernel
156s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JC_454f76ecaea8080ab5a9216ba319db0a58b015ed6497be6ac55b3b770236c43c.dll
Size

1.3MB
MD5

03ef9962144e8b824a974b5fc2d6b370
SHA1

c8cc15a1991559a7281078495b055fc6e766a45f
SHA256

454f76ecaea8080ab5a9216ba319db0a58b015ed6497be6ac55b3b770236c43c
SHA512

b21fbcc07468bd9e6c5316225ab4dd354d09e31059db6d78be4d7620ab9bed42a1d9f39cc229c0cb2e9d28998e0d149b26b0c2141b44b03c6c97662b243ffe1f
SSDEEP

24576:pcF24kalewp+N/U1s4LHu1zG6T63YAkI4gTMdzf:Kv251K6W3J9Tq

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

23.254.144.209:443

23.254.227.74:443

192.255.166.212:443

Attributes

embedded_hash
0E1A7A1479C37094441FA911262B322A
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral1/memory/1720-0-0x0000000001E20000-0x0000000001F81000-memory.dmp	DanabotLoader2021
behavioral1/memory/1720-1-0x0000000001E20000-0x0000000001F81000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1720	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1720	2240	rundll32.exe	27
PID 2240 wrote to memory of 1720	2240	rundll32.exe	27
PID 2240 wrote to memory of 1720	2240	rundll32.exe	27
PID 2240 wrote to memory of 1720	2240	rundll32.exe	27
PID 2240 wrote to memory of 1720	2240	rundll32.exe	27
PID 2240 wrote to memory of 1720	2240	rundll32.exe	27
PID 2240 wrote to memory of 1720	2240	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JC_454f76ecaea8080ab5a9216ba319db0a58b015ed6497be6ac55b3b770236c43c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JC_454f76ecaea8080ab5a9216ba319db0a58b015ed6497be6ac55b3b770236c43c.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x0000000001E20000-0x0000000001F81000-memory.dmp

Filesize
1.4MB

Download
memory/1720-1-0x0000000001E20000-0x0000000001F81000-memory.dmp

Filesize
1.4MB

Download