danabot | c7d9227cc6550ddba398fef4716d008d6391c701e84d12926e393f506b5a9b41

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2024 04:06

Target

b048cf76a36a041a196715ab6bc92ff5.dll
Size

1.3MB
MD5

b048cf76a36a041a196715ab6bc92ff5
SHA1

bb831338d55eb9fb3ab39ae81a4d2f1215e4d534
SHA256

c7d9227cc6550ddba398fef4716d008d6391c701e84d12926e393f506b5a9b41
SHA512

cf8017a5c5a4444492144607caef1904ea4d75742a48d9a5d2c4648ffb46e65b078237370e90a07002d06cb264d08c03c16356477b672168a8d47aa61fc21c38
SSDEEP

24576:L8pWEmDXswcrLEEcQ1fObM5HqTgNmsBdLTWnrO:QtSzeTBdLTq

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

13 3596 rundll32.exe

flow	pid	process
13	3596	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4204 wrote to memory of 3596	4204	rundll32.exe	rundll32.exe
PID 4204 wrote to memory of 3596	4204	rundll32.exe	rundll32.exe
PID 4204 wrote to memory of 3596	4204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b048cf76a36a041a196715ab6bc92ff5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b048cf76a36a041a196715ab6bc92ff5.dll,#1
2⤵
- Blocklisted process makes network request
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4056

memory/3596-0-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-1-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-2-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-3-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-4-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-5-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-6-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-7-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-8-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-9-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-10-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-11-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-12-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3596-13-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download