danabot | 7c660025e8fcbbe2d8a0a4d30f387b9a419b65e378b31e29341d0b75a43a90c0 | Triage

Analysis

max time kernel
143s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 17:20

Sharing

Report Analysis Logs

General

Target

68a1f21a2cde3413cf8476f9ce84cd57.dll
Size

1.3MB
MD5

68a1f21a2cde3413cf8476f9ce84cd57
SHA1

5c8a16ec64903ede295008ee2270f1c000464076
SHA256

7c660025e8fcbbe2d8a0a4d30f387b9a419b65e378b31e29341d0b75a43a90c0
SHA512

04dff02b3743f3c8eca47dd3e87a4bc24cc4b2ce20a2916bab335ad4094bb95721529fbe03ca4d43b84b9d24568fe29d85a0f96b6ab572e6bac68a33bf653888
SSDEEP

24576:KncFdxcZ3Mn9C2vOte0kS+RB39lTlotyT9uy6:BT2FBY9lfTIy6

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.242.31:443

192.119.110.73:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1912-0-0x0000000001F70000-0x00000000020D3000-memory.dmp	DanabotLoader2021
behavioral1/memory/1912-1-0x0000000001F70000-0x00000000020D3000-memory.dmp	DanabotLoader2021
behavioral1/memory/1912-2-0x0000000001F70000-0x00000000020D3000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1912 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2232 wrote to memory of 1912	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1912	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1912	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1912	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1912	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1912	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1912	2232	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68a1f21a2cde3413cf8476f9ce84cd57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68a1f21a2cde3413cf8476f9ce84cd57.dll,#1
2⤵
- Blocklisted process makes network request
PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-0-0x0000000001F70000-0x00000000020D3000-memory.dmp

Filesize
1.4MB

Download
memory/1912-1-0x0000000001F70000-0x00000000020D3000-memory.dmp

Filesize
1.4MB

Download
memory/1912-2-0x0000000001F70000-0x00000000020D3000-memory.dmp

Filesize
1.4MB

Download