danabot | 58ea1d838c8b5aa7db8abe518b15b6064e53c21d98cc91329aa67e8d31e13a3c

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 15:34

Target

505a780bb73036d59f49a44518ae555c.dll
Size

1.4MB
MD5

505a780bb73036d59f49a44518ae555c
SHA1

2ccebef0456acd8f5910bf30f3953dca7cc092ab
SHA256

58ea1d838c8b5aa7db8abe518b15b6064e53c21d98cc91329aa67e8d31e13a3c
SHA512

4be5684fbd10ae9bc33c1fd149851c9a8223ad99ff5c671ecfa147886cde6635d97a8263870a7a4a4fe6892998968f3d7634a8270305066d4422af05ed58f66f
SSDEEP

24576:4u9eawqFvymPU8ChCNQVw8+6SgImw2qXnTaLrS:RE0ilVwf9mFqXnT

Score

10^/10

Family

danabot

Botnet

142.11.242.31:443

192.119.110.73:443

192.210.222.88:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3052-0-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-1-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-2-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-3-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-4-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-5-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-6-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-7-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-8-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-9-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-10-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-11-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-12-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-13-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021
behavioral1/memory/3052-14-0x0000000001F80000-0x00000000020E5000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 3052 rundll32.exe

flow	pid	process
2	3052	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3048 wrote to memory of 3052	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 3052	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 3052	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 3052	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 3052	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 3052	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 3052	3048	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\505a780bb73036d59f49a44518ae555c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\505a780bb73036d59f49a44518ae555c.dll,#1
2⤵
- Blocklisted process makes network request
PID:3052

memory/3052-0-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-1-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-2-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-3-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-4-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-5-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-6-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-7-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-8-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-9-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-10-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-11-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-12-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-13-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/3052-14-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download