danabot | ccd44bf23b9115384965066a98ff481550138a5e50c99483b1baed22d241ddf6

Analysis

max time kernel
140s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
732a21fda50beab7e48cdf7bc8d270ee.dll
Size 1.3MB
Sample240124-3nsb8sbdf5
SHA256 ccd44bf23b9115384965066a98ff481550138a5e50c99483b1baed22d241ddf6
MD5 732a21fda50beab7e48cdf7bc8d270ee
SHA1 69bcbbfcc542f592f888ad78ff2fe953acb1ac8a
SHA512 5311d3538955b889b733e39fdd29b71a6b78487a0a98a6c6e8edf9084fe32cd32f36aacf13636171dd9d7e44c5e2c180877cbf88756e9bf26118d27064172e0c
SSDEEP 24576:NcF2f8wz+4UI1IXuQr1B76XPgQ2REackn0pTfYSXVm:uzVr1B7GGR3kTE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

23.229.29.48:443
5.9.224.204:443
192.210.222.81:443

Attributes

embedded_hash
0E1A7A1479C37094441FA911262B322A
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral2/memory/1664-0-0x0000000002490000-0x00000000025F1000-memory.dmp	DanabotLoader2021
behavioral2/memory/1664-1-0x0000000002490000-0x00000000025F1000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1664	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1664	2472	rundll32.exe	21
PID 2472 wrote to memory of 1664	2472	rundll32.exe	21
PID 2472 wrote to memory of 1664	2472	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\732a21fda50beab7e48cdf7bc8d270ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\732a21fda50beab7e48cdf7bc8d270ee.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-0-0x0000000002490000-0x00000000025F1000-memory.dmp

Download

memory/1664-1-0x0000000002490000-0x00000000025F1000-memory.dmp