danabot | 8f7a68b1679421993990b8d004e555a12cfef7452442977cbaebad0a927d4165

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 10:55

Target

772c06fa364981572fa5f8330b8c39c4.dll
Size

1.3MB
MD5

772c06fa364981572fa5f8330b8c39c4
SHA1

8ce99f8462953f6e7af604218b711611c9d009a1
SHA256

8f7a68b1679421993990b8d004e555a12cfef7452442977cbaebad0a927d4165
SHA512

e643f8bc9349228c4ff7c384f4a352c500c42c2ed700f7712a9b5a15ccdd99e0b2877b89008fd526ae34a1a41c1ffe2166274043cd63fb1a9a968990a451dfc5
SSDEEP

24576:0IhaxNGxQiAOuRGXtwRqbhWaAppPSWX3OtIm1KTG/:r92TaSp6WXbTe

Score

10^/10

Family

danabot

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2640-0-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-1-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-2-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-3-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-4-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-5-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-6-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-7-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-8-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-9-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-10-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-11-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-12-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-13-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021
behavioral1/memory/2640-14-0x0000000000A30000-0x0000000000B8C000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2640 rundll32.exe

flow	pid	process
2	2640	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1628 wrote to memory of 2640	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 2640	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 2640	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 2640	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 2640	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 2640	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 2640	1628	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\772c06fa364981572fa5f8330b8c39c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\772c06fa364981572fa5f8330b8c39c4.dll,#1
2⤵
- Blocklisted process makes network request
PID:2640

memory/2640-0-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-1-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-2-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-3-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-4-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-5-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-6-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-7-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-8-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-9-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-10-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-11-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-12-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-13-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download
memory/2640-14-0x0000000000A30000-0x0000000000B8C000-memory.dmp

Filesize
1.4MB

Download