danabot | 7878bda3be3cb15b032551a29c37fe5c30a9fba7a374348f88f1780d8c8b141a

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-01-2024 23:45

Target

855e8fa6226c46509f1e8cd1f6d1b502.dll
Size

1.3MB
MD5

855e8fa6226c46509f1e8cd1f6d1b502
SHA1

78320d10357a9c846955c39d4c9442d44357372c
SHA256

7878bda3be3cb15b032551a29c37fe5c30a9fba7a374348f88f1780d8c8b141a
SHA512

44db580df23028d49383c0415e1efc41f2eaac6e0c6f4c08bbcaf95a21937409168868c7fc016fb37704c879b5f4965230bee4b6ed371af35c3ef2ffb0faa16a
SSDEEP

24576:H8FGdTeNwtT15HhJpVREhatY3jAqQWT6mg1:cQ7VR+aUjEWTDq

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1676-0-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-1-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-2-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-3-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-4-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-5-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-6-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-7-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-8-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-9-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-10-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-11-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-12-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-13-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021
behavioral1/memory/1676-14-0x00000000023A0000-0x0000000002500000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1676 rundll32.exe

flow	pid	process
2	1676	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 944 wrote to memory of 1676	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1676	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1676	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1676	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1676	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1676	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1676	944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\855e8fa6226c46509f1e8cd1f6d1b502.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\855e8fa6226c46509f1e8cd1f6d1b502.dll,#1
2⤵
- Blocklisted process makes network request
PID:1676

memory/1676-0-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-1-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-2-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-3-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-4-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-5-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-6-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-7-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-8-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-9-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-10-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-11-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-12-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-13-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download
memory/1676-14-0x00000000023A0000-0x0000000002500000-memory.dmp

Filesize
1.4MB

Download