danabot | dd91475494e4d93d84cc3f322775d0b7f72a8ba2c2f67e00aaedc69ed31fac50

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 10:25

Target

771badc84e677aa3a3a5449f6e75380e.dll
Size

1.3MB
MD5

771badc84e677aa3a3a5449f6e75380e
SHA1

5c7dea1af55350ab4117156a362d33899fce4ea7
SHA256

dd91475494e4d93d84cc3f322775d0b7f72a8ba2c2f67e00aaedc69ed31fac50
SHA512

30865ccb9cd89368dc937058d57daf0c8e406819684189622b83c8f2b64f1bd0b6949a6abdd0f1dea854993305ae8c584c4020fa9cb39087e47784cd2fe345e1
SSDEEP

24576:78FG65iH5eqtKQBkpjvwykPYZVWtjUcTyZ1bn:gTT7MhJTe

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1988-0-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-1-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-2-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-3-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-4-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-5-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-6-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-7-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-8-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-9-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-10-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-11-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-12-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-13-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1988-14-0x0000000000950000-0x0000000000AB0000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1988 rundll32.exe

flow	pid	process
2	1988	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2256 wrote to memory of 1988	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 1988	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 1988	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 1988	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 1988	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 1988	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 1988	2256	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\771badc84e677aa3a3a5449f6e75380e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\771badc84e677aa3a3a5449f6e75380e.dll,#1
2⤵
- Blocklisted process makes network request
PID:1988

memory/1988-0-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-1-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-2-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-3-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-4-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-5-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-6-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-7-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-8-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-9-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-10-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-11-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-12-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-13-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download
memory/1988-14-0x0000000000950000-0x0000000000AB0000-memory.dmp

Filesize
1.4MB

Download