Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-01-2025 16:36

General

  • Target

    b24a88402e7e47b5239c76a77bdefb646096e44459285e45d72a37481a5ce95a.dll

  • Size

    1.3MB

  • MD5

    301125bdcffc98cf3b249aeec9fcec3b

  • SHA1

    fd35dde2dca443623fd6418b2d96675d61d8c834

  • SHA256

    b24a88402e7e47b5239c76a77bdefb646096e44459285e45d72a37481a5ce95a

  • SHA512

    1cc00325a04c8eec4cb878d88a203a4af6723a59eda4203cf647266959a3351cdbb507d4aabb82ad6e647bcfa07970cf2c690d570c88342898e94e6af20ddf32

  • SSDEEP

    24576:V8pWEmihq5YAWMg4G70JJ84Mla+rbjYKgETK5:2a5NRMD/YTETo

Malware Config

Extracted

Family

danabot

Botnet

4

C2

23.254.144.209:443

192.236.194.86:443

142.11.192.232:443

Attributes
  • embedded_hash

    0E1A7A1479C37094441FA911262B322A

  • type

    loader

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPvYED31s9p4zf6GMtg/u+PcE3
3
nZfynudhDfv9UkUfPbos2SlZ26IDACG5/jQNYcToWrfJiUO9rHtvi2OvyMM0sHdJ
4
KQVRs5DsWW+z2cSr3feptw4M2MoUKzr9hDPum7mJDoHCnp1QQ88CXGRFUkIgeDWQ
5
xtcCtZrs2sSQRqUMiwIDAQAB
6
-----END PUBLIC KEY-----
rsa_privkey.plain
1
-----BEGIN PRIVATE KEY-----
2
MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAO7duu10Qo2/v1o2
3
WSsJ4m7OU6LVq9YNRxwWc6VdGKHid9s8ZnrsfesL1vPu/xn34MHFwePjBeG8uTP0
4
A8YlBpvoM8jijxi1r+q+NM7TW09L+YeZan3uDXsIQu6Qc2HZpySwRdhUORMmDYB0
5
eDo07Nz/aR/HeCjiChI/vnaI7uHnAgMBAAECgYBuD4KS6M/FqoVL1uDtIMfRkIYe
6
8F8V6NZMDdhJaITyCnx5avI5T4CRbcokaYnneDx6bFlzXGaYZbHcS2H1yZeqGMLA
7
mDdAMOWDSHHbF8GlhRZ9X9mhn5MWwPmy0utEQZCTelt3nXEgkwk4JaOup3yYRlku
8
dokEwoVektX6Q67bQQJBAPrjGTJTpBF6IWb9it8XfIlbVlLLs7xlIOEuFkHkUNUY
9
bvcXVTqrvvzcQbvbWEgAUNeCHUkjaQowGyJ1PrT/CUcCQQDzu+rP2MWtnUWUybiT
10
gMrTz4DNS9/Pbevbk1VY4BpckvCZ7vjl0KiA+Mpq0r9CRmd9jowDFlE/WqfJg3ed

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot Loader Component 15 IoCs
  • Danabot family
  • Blocklisted process makes network request 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b24a88402e7e47b5239c76a77bdefb646096e44459285e45d72a37481a5ce95a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b24a88402e7e47b5239c76a77bdefb646096e44459285e45d72a37481a5ce95a.dll,#1
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      PID:1732

Network

    No results found
  • 23.254.144.209:443
    https
    rundll32.exe
    166 B
    92 B
    3
    2
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1732-0-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-1-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-2-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-3-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-4-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-5-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-6-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-7-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-8-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-9-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-10-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-11-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-12-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-13-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

  • memory/1732-14-0x00000000007B0000-0x0000000000912000-memory.dmp

    Filesize

    1.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.