danabot | 988d89d3b907b582e8c73f03a41c29d25f1efb3b7731b16692104047f5ceff54

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 04:27

Target

85eca4d79e6d5641120c37d371f7759e.dll
Size

1.3MB
MD5

85eca4d79e6d5641120c37d371f7759e
SHA1

12fdac7db7a90687eec642e452c8273f0612fb1f
SHA256

988d89d3b907b582e8c73f03a41c29d25f1efb3b7731b16692104047f5ceff54
SHA512

236bddfa1ac7ddea47c54540329d565c27f3beac9aad8baecd0aed0a2196b2b7da722e3acda7eefa52b1fe58dfa2b0beeab74bcdf9a1f24b44e3b5bd45763398
SSDEEP

24576:L8pWEmDXswcrLEEcQ1fObM5HqTgNmsBdPTWnrO:QtSzeTBdPTq

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2528 rundll32.exe

flow	pid	process
2	2528	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1740 wrote to memory of 2528	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2528	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2528	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2528	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2528	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2528	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2528	1740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85eca4d79e6d5641120c37d371f7759e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85eca4d79e6d5641120c37d371f7759e.dll,#1
2⤵
- Blocklisted process makes network request
PID:2528

memory/2528-0-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-1-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-2-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-3-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-4-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-5-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-6-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-7-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-8-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-9-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-10-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-11-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-12-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-13-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download
memory/2528-14-0x00000000020F0000-0x0000000002252000-memory.dmp

Filesize
1.4MB

Download