danabot | cb0ead96e47c2a53d1d8ce8d6982c85dec0f103011924e58fffea13a83eb9654

Analysis

max time kernel
155s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:16

Target

c6e03fe261880f32b1d07c3e0215257a.dll
Size

1.3MB
MD5

c6e03fe261880f32b1d07c3e0215257a
SHA1

850cd9178fec877341514e8c78b3f951676733e7
SHA256

cb0ead96e47c2a53d1d8ce8d6982c85dec0f103011924e58fffea13a83eb9654
SHA512

5cbbe55e5671a847b8f12b5d9458e3af3638c10527130def2b7905c86ef8a7e4bc7acd619f487668f03a1b462ed4f298abca8559f9fdb2e72c252d059efe1c7e
SSDEEP

24576:RcF2ddLBEH/yuGeb3+yPbduheDDx0OJ16TPWi+D:SQ3yhugD2Tu5D

Score

10^/10

Family

danabot

Botnet

104.168.148.6:443

5.9.224.204:443

192.210.222.81:443

23.229.29.48:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2496	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2496	2920	rundll32.exe	28
PID 2920 wrote to memory of 2496	2920	rundll32.exe	28
PID 2920 wrote to memory of 2496	2920	rundll32.exe	28
PID 2920 wrote to memory of 2496	2920	rundll32.exe	28
PID 2920 wrote to memory of 2496	2920	rundll32.exe	28
PID 2920 wrote to memory of 2496	2920	rundll32.exe	28
PID 2920 wrote to memory of 2496	2920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6e03fe261880f32b1d07c3e0215257a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6e03fe261880f32b1d07c3e0215257a.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2496

memory/2496-0-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-1-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-2-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-3-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-4-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-5-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-6-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-7-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-8-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-9-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-10-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-11-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-12-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-13-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/2496-14-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download