danabot | e1d1cbf3c976e260ba56e67bb058ab5a89a46f63ef20e77cff7bc72f45fe7318

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 21:44

Target

97add543482f00fa819e2cf732b365e9.dll
Size

1.3MB
MD5

97add543482f00fa819e2cf732b365e9
SHA1

6d978b03d43181577c0e24c4262128c9a47bab8c
SHA256

e1d1cbf3c976e260ba56e67bb058ab5a89a46f63ef20e77cff7bc72f45fe7318
SHA512

525c2a5b2c37795bb14ad7bed7769d8ad77127b51b5311adefe8c4f9e67b1c2dc9caddf236ae04b6f9411034a92ea23346210b1a637a423f3d27e93c24db9d9b
SSDEEP

24576:L8pWEmDXswcrLEEcQ1fObM5HqTgNmsBdpTWnrO:QtSzeTBdpTq

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1036 rundll32.exe

flow	pid	process
2	1036	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 760 wrote to memory of 1036	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1036	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1036	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1036	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1036	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1036	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1036	760	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97add543482f00fa819e2cf732b365e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97add543482f00fa819e2cf732b365e9.dll,#1
2⤵
- Blocklisted process makes network request
PID:1036

memory/1036-0-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-1-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-2-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-3-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-4-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-5-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-6-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-7-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-8-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-9-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-10-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-11-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-12-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-13-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download
memory/1036-14-0x0000000000A80000-0x0000000000BE2000-memory.dmp

Filesize
1.4MB

Download