danabot | c4efdda580eeea9fa344230cf596b6aa5a6ee86d2c5f78158695677cfc0565a2

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4ba30ceb035656701cbf2bd1a570bd7.dll
Size

1.3MB
MD5

b4ba30ceb035656701cbf2bd1a570bd7
SHA1

999a814fd2e5c5799e93e0e04fd56db65a7f8cc6
SHA256

c4efdda580eeea9fa344230cf596b6aa5a6ee86d2c5f78158695677cfc0565a2
SHA512

1486d3ed5fc984a422ae37b725a7a65240487cda4810026466d98e4634db5b48f9f1fb93dd9a2ffb05f1633ef1cf9456a7b513d1e570b4a38d782b77df929e27
SSDEEP

24576:x8FGlBf62BjX78GfHDZ3WnzL+ZLvMC8B7TiJAB6l:ymJ5qo81T

Score

10^/10

danabot 5 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

192.210.222.81:443

23.229.29.48:443

5.9.224.204:443

192.255.166.212:443

Attributes

embedded_hash
100700D372965A717E89B8C909E1D8D4
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

resource	yara_rule
behavioral1/memory/2792-0-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-1-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-2-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-3-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-4-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-5-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-6-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-7-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-8-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-9-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-10-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-11-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-12-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-13-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021
behavioral1/memory/2792-14-0x0000000001E00000-0x0000000001F60000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2792	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2792	2100	rundll32.exe	28
PID 2100 wrote to memory of 2792	2100	rundll32.exe	28
PID 2100 wrote to memory of 2792	2100	rundll32.exe	28
PID 2100 wrote to memory of 2792	2100	rundll32.exe	28
PID 2100 wrote to memory of 2792	2100	rundll32.exe	28
PID 2100 wrote to memory of 2792	2100	rundll32.exe	28
PID 2100 wrote to memory of 2792	2100	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4ba30ceb035656701cbf2bd1a570bd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4ba30ceb035656701cbf2bd1a570bd7.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-1-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-2-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-3-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-4-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-5-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-6-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-7-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-8-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-9-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-10-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-11-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-12-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-13-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download
memory/2792-14-0x0000000001E00000-0x0000000001F60000-memory.dmp

Filesize
1.4MB

Download