danabot | f301dfbb7b19c488f8457733d8cce8403814fd518984a0470e963a060bd86b17

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e1616ac16e7015b0a14e174b2dfe94e.dll
Size

1.3MB
MD5

1e1616ac16e7015b0a14e174b2dfe94e
SHA1

3b640c7df4eec6c1711b36a60dffe575be0b9a79
SHA256

f301dfbb7b19c488f8457733d8cce8403814fd518984a0470e963a060bd86b17
SHA512

58ed9d585037bd48446336a1d60f29bee5acf02a5cdac791e102f6178664fdef6c16abb658a46cecc9fb93b8ae020864ad7f043f7892ebc9c738cf10f6af3470
SSDEEP

24576:RcF2ddLBEH/yuGeb3+yPbduheDDx0OJ1nTPWi+D:SQ3yhugD7Tu5D

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

104.168.148.6:443

5.9.224.204:443

192.210.222.81:443

23.229.29.48:443

Attributes

embedded_hash
0E1A7A1479C37094441FA911262B322A
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1660	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1660	2504	rundll32.exe	28
PID 2504 wrote to memory of 1660	2504	rundll32.exe	28
PID 2504 wrote to memory of 1660	2504	rundll32.exe	28
PID 2504 wrote to memory of 1660	2504	rundll32.exe	28
PID 2504 wrote to memory of 1660	2504	rundll32.exe	28
PID 2504 wrote to memory of 1660	2504	rundll32.exe	28
PID 2504 wrote to memory of 1660	2504	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e1616ac16e7015b0a14e174b2dfe94e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e1616ac16e7015b0a14e174b2dfe94e.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-0-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-1-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-2-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-3-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-4-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-5-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-6-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-7-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-8-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-9-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-10-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-11-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-12-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-13-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download
memory/1660-14-0x0000000000930000-0x0000000000A91000-memory.dmp

Filesize
1.4MB

Download