danabot | caeba1910c89f2122e91e962d96987421b822487681d549bcf9d3118d1b87bb4

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 18:17

Target

80893465004ba8821412c5815efad34b.exe
Size

1.0MB
MD5

80893465004ba8821412c5815efad34b
SHA1

0af98a99a81e59ccc450872b15e5f857ce77f408
SHA256

caeba1910c89f2122e91e962d96987421b822487681d549bcf9d3118d1b87bb4
SHA512

773b1e8b48b815185e3c2847d25707275f07f89b0929ba32f3eaa97f52b89c1b9777e1e788a8826cfa54f86bf31f08f0535f9f9e936e3e5caf5761efc422cd76
SSDEEP

24576:GeqrjrakGkowvldxnK2uWBnnB4YVApRXITalmjaw:MmkowvdK2nnnBudCf

Score

10^/10

Family

danabot

Botnet

193.34.167.138:443

152.89.247.31:443

192.210.222.81:443

142.11.244.124:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\808934~1.TMP	DanabotLoader2021
behavioral1/memory/2168-9-0x0000000000450000-0x00000000005AD000-memory.dmp	DanabotLoader2021
behavioral1/memory/2168-12-0x0000000000450000-0x00000000005AD000-memory.dmp	DanabotLoader2021
behavioral1/memory/2168-20-0x0000000000450000-0x00000000005AD000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2168 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2168 rundll32.exe

flow	pid	process
2	2168	rundll32.exe

pid	process
2168	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

80893465004ba8821412c5815efad34b.exe

description	pid	process	target process
PID 2160 wrote to memory of 2168	2160	80893465004ba8821412c5815efad34b.exe	rundll32.exe
PID 2160 wrote to memory of 2168	2160	80893465004ba8821412c5815efad34b.exe	rundll32.exe
PID 2160 wrote to memory of 2168	2160	80893465004ba8821412c5815efad34b.exe	rundll32.exe
PID 2160 wrote to memory of 2168	2160	80893465004ba8821412c5815efad34b.exe	rundll32.exe
PID 2160 wrote to memory of 2168	2160	80893465004ba8821412c5815efad34b.exe	rundll32.exe
PID 2160 wrote to memory of 2168	2160	80893465004ba8821412c5815efad34b.exe	rundll32.exe
PID 2160 wrote to memory of 2168	2160	80893465004ba8821412c5815efad34b.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\80893465004ba8821412c5815efad34b.exe
"C:\Users\Admin\AppData\Local\Temp\80893465004ba8821412c5815efad34b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Users\Admin\AppData\Local\Temp\808934~1.TMP

Filesize
1.3MB

MD5
cfc25f6127c1542eee376a6b9fb0d3d9

SHA1
cf1c89eba15320765f2b6ebced98edd77ed67a6e

SHA256
8af95e7b245deede697fbb9081551dd88610dfd72a0cba790c7c382c29f99ccc

SHA512
4dbb5f03fecd7da3833197b36288d0431820ba72ede7d0c07bfa9aae7ffcddf67ab6f1acf6f46567d69b0b90d042067c602cf02e6d527cf7e79271339034295d

Download Submit
memory/2160-0-0x0000000004560000-0x0000000004649000-memory.dmp

Filesize
932KB

Download
memory/2160-1-0x0000000004560000-0x0000000004649000-memory.dmp

Filesize
932KB

Download
memory/2160-2-0x0000000004720000-0x000000000481E000-memory.dmp

Filesize
1016KB

Download
memory/2160-7-0x0000000000400000-0x0000000002D94000-memory.dmp

Filesize
41.6MB

Download
memory/2160-5-0x0000000000400000-0x0000000002D94000-memory.dmp

Filesize
41.6MB

Download
memory/2160-11-0x0000000004560000-0x0000000004649000-memory.dmp

Filesize
932KB

Download
memory/2160-10-0x0000000004720000-0x000000000481E000-memory.dmp

Filesize
1016KB

Download
memory/2168-9-0x0000000000450000-0x00000000005AD000-memory.dmp

Filesize
1.4MB

Download
memory/2168-12-0x0000000000450000-0x00000000005AD000-memory.dmp

Filesize
1.4MB

Download
memory/2168-20-0x0000000000450000-0x00000000005AD000-memory.dmp

Filesize
1.4MB

Download