danabot | 28fa575f01a653c7f85b41df580a2e8a7685f8cc13723e27e75ed66f31e1e0fe

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 00:22

Target

a4fa2a175989786657de8c66b36951e1.dll
Size

1.3MB
MD5

a4fa2a175989786657de8c66b36951e1
SHA1

92855d859ece1f82bda7a9dc0db9629b93eb5173
SHA256

28fa575f01a653c7f85b41df580a2e8a7685f8cc13723e27e75ed66f31e1e0fe
SHA512

8e47bb4df061450da4851db126126bb5a15d3ca79f5c4d0027d02bf343b7a12920c819ca6f7ac87a8b39eb37d3ad287fd275f5ac1a52a54e4b207989b0a501eb
SSDEEP

12288:Ns8Fy+Hu9nN4vYH2a7Ncf04W2O/SYOsm99UXvkTeMRsHQ0:S8FGyvFaRg04W2O6YOsm99dTeMyH

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1232-0-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-1-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-2-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-3-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-4-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-5-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-6-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-7-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-8-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-9-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-10-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-11-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-12-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-13-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021
behavioral1/memory/1232-14-0x00000000007C0000-0x0000000000920000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1232 rundll32.exe

flow	pid	process
2	1232	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2400 wrote to memory of 1232	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 1232	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 1232	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 1232	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 1232	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 1232	2400	rundll32.exe	rundll32.exe
PID 2400 wrote to memory of 1232	2400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4fa2a175989786657de8c66b36951e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4fa2a175989786657de8c66b36951e1.dll,#1
2⤵
- Blocklisted process makes network request
PID:1232

memory/1232-0-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-1-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-2-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-3-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-4-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-5-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-6-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-7-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-8-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-9-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-10-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-11-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-12-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-13-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download
memory/1232-14-0x00000000007C0000-0x0000000000920000-memory.dmp

Filesize
1.4MB

Download