danabot | 1e51f18092d8b33ce540f0be383e973e3bb962de84630144d4a40f70d74551f3

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 18:28

Target

54415694e11467be54aa0e5fc0c63ee5.exe
Size

1.0MB
MD5

54415694e11467be54aa0e5fc0c63ee5
SHA1

adb1fa18fc275e98e26660621b74ee188fb0b66b
SHA256

1e51f18092d8b33ce540f0be383e973e3bb962de84630144d4a40f70d74551f3
SHA512

cebffcba8a75b2cac7ecbca1b62c1e1862f364d24ded2ab4541bb92cd1448bcad30d03b01b3faaf94d1602f56ca1bd720d76da782762df35f90f54191c69ec42
SSDEEP

24576:mZlJEIt2wdfQlda/BnHUmdtqqAqMenRFNEuA5u0u5XjO+MG1c:mZ3EIt2wdyElnAqMekiX

Score

10^/10

Family

danabot

Botnet

192.210.222.81:443

23.229.29.48:443

5.9.224.204:443

192.255.166.212:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\544156~1.DLL	DanabotLoader2021
behavioral2/memory/1812-11-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1812-25-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1812-26-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

285 1812 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1812 rundll32.exe

flow	pid	process
285	1812	rundll32.exe

pid	process
1812	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

54415694e11467be54aa0e5fc0c63ee5.exe

description	pid	process	target process
PID 1436 wrote to memory of 1812	1436	54415694e11467be54aa0e5fc0c63ee5.exe	rundll32.exe
PID 1436 wrote to memory of 1812	1436	54415694e11467be54aa0e5fc0c63ee5.exe	rundll32.exe
PID 1436 wrote to memory of 1812	1436	54415694e11467be54aa0e5fc0c63ee5.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\54415694e11467be54aa0e5fc0c63ee5.exe
"C:\Users\Admin\AppData\Local\Temp\54415694e11467be54aa0e5fc0c63ee5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Local\Temp\544156~1.DLL
Filesize
1.3MB

MD5
0355b6cd756a4a8cb264ed389e1855f1

SHA1
9576c92d3fa4989d3194b53346acab139b81ff34

SHA256
31a167b2bf229c744f335083b1757f410a5e453e5bac05d9afbac15655e1d7af

SHA512
e87b5513035c8cbdb66763efb1c1d128e084b8ef12496126924daa3921bcff60614ea725080031a03ed1c239610f390aea600bb15655e58bacffa295ef63046d

Download Submit
memory/1436-2-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/1436-10-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/1436-22-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/1812-11-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1812-25-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1812-26-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download