danabot | bd2209b9d5f3348f0b9bd52b86dfb0bc805510f0386d5c8688def5455728cbbc

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 22:24

Target

b5ce2f20a7bc94a4b0dd28ef75075a09.dll
Size

1.3MB
MD5

b5ce2f20a7bc94a4b0dd28ef75075a09
SHA1

04a2f781040618117075bf9e07f4aa6d909d92c2
SHA256

bd2209b9d5f3348f0b9bd52b86dfb0bc805510f0386d5c8688def5455728cbbc
SHA512

89c90faa8e8e68f382de2b4e56df8438761a2fd70229593f46a340343af4c298fa6b4d4eb9d5cc943b87047f33a12e6d11fef7140945fa7e93020f03fe5db8bd
SSDEEP

24576:U8FGkledaJlotqQtw/Mwo6aKhmQZ6dtu9weUT8ThC:XfZ6dtu+eUT8T

Score

10^/10

Family

danabot

Botnet

192.210.222.81:443

23.229.29.48:443

5.9.224.204:443

192.255.166.212:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/356-0-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-1-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-2-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-3-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-4-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-5-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-6-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-7-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-8-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-9-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-10-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-11-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-12-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-13-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021
behavioral1/memory/356-14-0x0000000000B50000-0x0000000000CB0000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 356 rundll32.exe

flow	pid	process
2	356	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1940 wrote to memory of 356	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 356	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 356	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 356	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 356	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 356	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 356	1940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5ce2f20a7bc94a4b0dd28ef75075a09.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5ce2f20a7bc94a4b0dd28ef75075a09.dll,#1
2⤵
- Blocklisted process makes network request
PID:356

memory/356-0-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-1-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-2-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-3-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-4-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-5-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-6-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-7-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-8-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-9-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-10-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-11-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-12-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-13-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download
memory/356-14-0x0000000000B50000-0x0000000000CB0000-memory.dmp

Filesize
1.4MB

Download