danabot | 134bf73abd898fa7c3f686ada2294b18288cd3542310d9f609867d31cf36e2eb

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 10:41

Target

134bf73abd898fa7c3f686ada2294b18288cd3542310d9f609867d31cf36e2eb.dll
Size

1.3MB
MD5

06dc71fb0396f27a50200e7c800c56d9
SHA1

52df8d8b3daaaef060616c5ada6039fca1f447e6
SHA256

134bf73abd898fa7c3f686ada2294b18288cd3542310d9f609867d31cf36e2eb
SHA512

ccd32b03ac68ac7213c39e336f3e1f186bfcaa5210f47a762d96f0c9130ce02a4156f54701faea6c512eeaa33850e96828e9a53c15930d6c999ebcab23e1a29f
SSDEEP

24576:qcFXBjis24E0ykpDOxlEtesuSibHsVS+kVTTQPTBWcys:RD2JKtesQbHd+cT2BWPs

Score

10^/10

Family

danabot

Botnet

192.236.161.79:443

192.236.146.39:443

37.220.31.27:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2116	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\134bf73abd898fa7c3f686ada2294b18288cd3542310d9f609867d31cf36e2eb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\134bf73abd898fa7c3f686ada2294b18288cd3542310d9f609867d31cf36e2eb.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2116

memory/2116-0-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-1-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-2-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-3-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-4-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-5-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-6-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-7-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-8-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-9-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-10-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-11-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-12-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-13-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download
memory/2116-14-0x0000000000600000-0x000000000075C000-memory.dmp

Filesize
1.4MB

Download