danabot | 2cb40a44c4b793d9ce9fb35eef324f97a0841dccf972f1dde0fa71e2332ac7e9

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 06:48

Target

7f2bd352c8b7d4b2d92554e01e6dd1e1.dll
Size

1.3MB
MD5

7f2bd352c8b7d4b2d92554e01e6dd1e1
SHA1

005051ce716858cfc632ccab0591acb3cfb9ec82
SHA256

2cb40a44c4b793d9ce9fb35eef324f97a0841dccf972f1dde0fa71e2332ac7e9
SHA512

c9547c27841824cfd845a57b1982e0a3bde0ecc7ff097dbe67f6627f09858ec4aa98531bfce3ec419cbfe7fbf9d7726c56fa9532d05530f19a76c2d91cbe978a
SSDEEP

12288:QccFyQh5cKd6aC1tnHKAw4rX0BrSjy+2Zj6YdEiH27EkkToNBQL96i1Wy:TcFXBIawtVw4rX+rSu+2HHsCToMc

Score

10^/10

Family

danabot

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2240-0-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-1-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-2-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-3-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-4-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-5-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-6-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-7-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-8-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-9-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-10-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-11-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-12-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-13-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2240-14-0x0000000001CB0000-0x0000000001E0D000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2240 rundll32.exe

flow	pid	process
2	2240	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 456 wrote to memory of 2240	456	rundll32.exe	rundll32.exe
PID 456 wrote to memory of 2240	456	rundll32.exe	rundll32.exe
PID 456 wrote to memory of 2240	456	rundll32.exe	rundll32.exe
PID 456 wrote to memory of 2240	456	rundll32.exe	rundll32.exe
PID 456 wrote to memory of 2240	456	rundll32.exe	rundll32.exe
PID 456 wrote to memory of 2240	456	rundll32.exe	rundll32.exe
PID 456 wrote to memory of 2240	456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f2bd352c8b7d4b2d92554e01e6dd1e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f2bd352c8b7d4b2d92554e01e6dd1e1.dll,#1
2⤵
- Blocklisted process makes network request
PID:2240

memory/2240-0-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-1-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-2-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-3-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-4-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-5-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-6-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-7-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-8-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-9-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-10-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-11-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-12-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-13-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download
memory/2240-14-0x0000000001CB0000-0x0000000001E0D000-memory.dmp

Filesize
1.4MB

Download