danabot | cf2072e20adf6725face6676b96eafe462a6e6caba7872eddaf781d205bd0f07

Analysis

max time kernel
147s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 10:58

Target

86b85af1db1464e1db70694e7e968375.exe
Size

1.1MB
MD5

86b85af1db1464e1db70694e7e968375
SHA1

3250e49a26d7296006e2ecd719c1f14541797ed2
SHA256

cf2072e20adf6725face6676b96eafe462a6e6caba7872eddaf781d205bd0f07
SHA512

d3024c2e2c3fa8c91ee521510185ede40a8246eba3e1418a68346adf7c4b72f8fc4308ceaed871ac5535e0cc1fd0a7a35dacb23b821028b65f2e15e173e8f687
SSDEEP

24576:rnaYDQsM4t7Iq8WtApeuHn7r+VsFI+YXmMdtarZ1N4:5161JE8n7rbFI+YBYrZ1N4

Score

10^/10

Family

danabot

Botnet

104.168.148.6:443

5.9.224.204:443

192.210.222.81:443

23.229.29.48:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2392 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

2392 rundll32.exe
2392 rundll32.exe
2392 rundll32.exe
2392 rundll32.exe

flow	pid	process
2	2392	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

86b85af1db1464e1db70694e7e968375.exe

description	pid	process	target process
PID 308 wrote to memory of 2392	308	86b85af1db1464e1db70694e7e968375.exe	rundll32.exe
PID 308 wrote to memory of 2392	308	86b85af1db1464e1db70694e7e968375.exe	rundll32.exe
PID 308 wrote to memory of 2392	308	86b85af1db1464e1db70694e7e968375.exe	rundll32.exe
PID 308 wrote to memory of 2392	308	86b85af1db1464e1db70694e7e968375.exe	rundll32.exe
PID 308 wrote to memory of 2392	308	86b85af1db1464e1db70694e7e968375.exe	rundll32.exe
PID 308 wrote to memory of 2392	308	86b85af1db1464e1db70694e7e968375.exe	rundll32.exe
PID 308 wrote to memory of 2392	308	86b85af1db1464e1db70694e7e968375.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\86b85af1db1464e1db70694e7e968375.exe
"C:\Users\Admin\AppData\Local\Temp\86b85af1db1464e1db70694e7e968375.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:308

\Users\Admin\AppData\Local\Temp\86B85A~1.DLL

Filesize
1.3MB

MD5
e24f738740824f62acfe1ccb1a4ad4c9

SHA1
7d9cd767e3b79604358ac6bad4cf5e39b7d26ecc

SHA256
6ebe53e58b12c0ce892a60342743a15e245e1aa978e32fb9ae1da55af144625e

SHA512
9fbdfdbadca41db5840495c34e24bb4f65a0533945866e0db566a1208f7cd299689c4eb88d1cb8ff5206cb21eb9b098fde02710d4bacad3065e7bae6c9275838

Download Submit
memory/308-5-0x0000000000400000-0x000000000248C000-memory.dmp

Filesize
32.5MB

Download
memory/308-2-0x0000000003E00000-0x0000000003F04000-memory.dmp

Filesize
1.0MB

Download
memory/308-0-0x0000000002490000-0x000000000257D000-memory.dmp

Filesize
948KB

Download
memory/308-6-0x0000000000400000-0x000000000248C000-memory.dmp

Filesize
32.5MB

Download
memory/308-8-0x0000000003E00000-0x0000000003F04000-memory.dmp

Filesize
1.0MB

Download
memory/308-1-0x0000000002490000-0x000000000257D000-memory.dmp

Filesize
948KB

Download
memory/308-19-0x0000000000400000-0x000000000248C000-memory.dmp

Filesize
32.5MB

Download
memory/308-32-0x0000000000400000-0x000000000248C000-memory.dmp

Filesize
32.5MB

Download
memory/2392-18-0x0000000001DC0000-0x0000000001F21000-memory.dmp

Filesize
1.4MB

Download
memory/2392-20-0x0000000001DC0000-0x0000000001F21000-memory.dmp

Filesize
1.4MB

Download
memory/2392-33-0x0000000001DC0000-0x0000000001F21000-memory.dmp

Filesize
1.4MB

Download
memory/2392-34-0x0000000001DC0000-0x0000000001F21000-memory.dmp

Filesize
1.4MB

Download