danabot | 1c9c2707a7617cd68cebd3da2736bb6ab0aab1393efe8e2b67d2ad35dbdc78b9

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
999434e48acc182fe2c0f9c46d65db0b.dll
Size 1.3MB
Sample240213-q4d4bsbd4w
SHA256 1c9c2707a7617cd68cebd3da2736bb6ab0aab1393efe8e2b67d2ad35dbdc78b9
MD5 999434e48acc182fe2c0f9c46d65db0b
SHA1 731a4351f7bacbbc840f0f6d8dc027d3dc467225
SHA512 341385707fc6bcaff28e341df1b867d1a1230c9f0a06b4a3790dbe3f48c541b2135ed9d4e67342a235a37727e03329535972756ca8c7c1f5426b210dae5bbea7
SSDEEP 24576:VcF2ZKxe3vVqJO0TbCsmp2Hvjmhghl2J/yd1uu08Tf9:WqdqyuLXlw/C1uuPT1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot 5 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

192.210.222.81:443
23.229.29.48:443
5.9.224.204:443

Attributes

embedded_hash
9DA7F8A90163192F72181508365A7F8E
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral2/memory/4020-0-0x0000000001E50000-0x0000000001FB1000-memory.dmp	DanabotLoader2021
behavioral2/memory/4020-1-0x0000000001E50000-0x0000000001FB1000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	4020	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 4020	2216	rundll32.exe	85
PID 2216 wrote to memory of 4020	2216	rundll32.exe	85
PID 2216 wrote to memory of 4020	2216	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\999434e48acc182fe2c0f9c46d65db0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\999434e48acc182fe2c0f9c46d65db0b.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4020-0-0x0000000001E50000-0x0000000001FB1000-memory.dmp

Download

memory/4020-1-0x0000000001E50000-0x0000000001FB1000-memory.dmp