danabot | 45498fc7ad058a572bb653f5307d549ac6f72c9c016a0f7f9b3134bbb8a5b29d

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 06:11

Target

a12506001fec6fba3c9b4f7a9c837349.dll
Size

1.3MB
MD5

a12506001fec6fba3c9b4f7a9c837349
SHA1

ee1077557fcd031a70b3bbb8aa82dcc273690c6f
SHA256

45498fc7ad058a572bb653f5307d549ac6f72c9c016a0f7f9b3134bbb8a5b29d
SHA512

d5e72bac10eb13992ccb8cb1e38b717a29682849a7bf30cefaba94a1bc36d000d5cb598a6e1be7ffccb81e2b713f6495d6d9f822468c69c65c2b58f1fd5c2278
SSDEEP

24576:y8pWEmNN85Fhyuqsghhg0SWKyolmi3TOfU:ZlMgYvoD3T6

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2912-0-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-1-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-2-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-3-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-4-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-5-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-6-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-7-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-8-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-9-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-10-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-11-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-12-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-13-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021
behavioral1/memory/2912-14-0x0000000000920000-0x0000000000A82000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2912 rundll32.exe

flow	pid	process
2	2912	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2092 wrote to memory of 2912	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2912	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2912	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2912	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2912	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2912	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2912	2092	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a12506001fec6fba3c9b4f7a9c837349.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a12506001fec6fba3c9b4f7a9c837349.dll,#1
2⤵
- Blocklisted process makes network request
PID:2912

memory/2912-0-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-1-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-2-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-3-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-4-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-5-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-6-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-7-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-8-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-9-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-10-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-11-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-12-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-13-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download
memory/2912-14-0x0000000000920000-0x0000000000A82000-memory.dmp

Filesize
1.4MB

Download