danabot | e1d1cbf3c976e260ba56e67bb058ab5a89a46f63ef20e77cff7bc72f45fe7318

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 21:44

Target

97add543482f00fa819e2cf732b365e9.dll
Size

1.3MB
MD5

97add543482f00fa819e2cf732b365e9
SHA1

6d978b03d43181577c0e24c4262128c9a47bab8c
SHA256

e1d1cbf3c976e260ba56e67bb058ab5a89a46f63ef20e77cff7bc72f45fe7318
SHA512

525c2a5b2c37795bb14ad7bed7769d8ad77127b51b5311adefe8c4f9e67b1c2dc9caddf236ae04b6f9411034a92ea23346210b1a637a423f3d27e93c24db9d9b
SSDEEP

24576:L8pWEmDXswcrLEEcQ1fObM5HqTgNmsBdpTWnrO:QtSzeTBdpTq

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

1 4676 rundll32.exe

flow	pid	process
1	4676	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4664 wrote to memory of 4676	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4676	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4676	4664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97add543482f00fa819e2cf732b365e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97add543482f00fa819e2cf732b365e9.dll,#1
2⤵
- Blocklisted process makes network request
PID:4676

memory/4676-0-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-1-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-2-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-3-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-4-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-5-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-6-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-7-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-8-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-9-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-10-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-11-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-12-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4676-13-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download