danabot | 6a38e4299c2bbd0bfea4e554c00f35e5edd66ae522c87b6b3a5250c83dae238d

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:45

Target

2228d0f83aeaca32a90b4b3db3621de3.dll
Size

1.3MB
MD5

2228d0f83aeaca32a90b4b3db3621de3
SHA1

183ea4cccb350586a4b26b79620c8bb3f93d7288
SHA256

6a38e4299c2bbd0bfea4e554c00f35e5edd66ae522c87b6b3a5250c83dae238d
SHA512

4d544c05eaa5f61095e2cc8b246db29ac9f8f241a6757d6bd27c5ea44aa5b224a75b349262f703ae6ce298c95ef9ab29bd814c61c641befc3904616bc2b7c163
SSDEEP

24576:icF2KZ+4NVvHR70eyKJ/zMLwyiKldjTl/wL:pJ0eZJ/zU7L7Tq

Score

10^/10

Family

danabot

Botnet

192.210.222.81:443

23.229.29.48:443

5.9.224.204:443

192.255.166.212:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 296 rundll32.exe

flow	pid	process
2	296	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 312 wrote to memory of 296	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 296	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 296	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 296	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 296	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 296	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 296	312	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2228d0f83aeaca32a90b4b3db3621de3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:312

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2228d0f83aeaca32a90b4b3db3621de3.dll,#1
2⤵
- Blocklisted process makes network request
PID:296

memory/296-0-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-1-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-2-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-3-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-4-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-5-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-6-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-7-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-8-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-9-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-10-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-11-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-12-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-13-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download
memory/296-14-0x0000000001E40000-0x0000000001FA1000-memory.dmp

Filesize
1.4MB

Download