danabot | bd2cd1dde1a7bee943b5efafb2619bf9cec5f3892923edb1eff434e117380011

Analysis

max time kernel
141s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe
Size

1.1MB
MD5

2645af6d5f97b523b1ca99bea1c6406c
SHA1

f6f9ac3db5bf170ade1944acd274876a635200ae
SHA256

bd2cd1dde1a7bee943b5efafb2619bf9cec5f3892923edb1eff434e117380011
SHA512

1fc61092b4352f690abe22503ac6dc8258a4da94b1a953b678a0b74da92f2261f788b91c055ac0bd1edf12cd5e71ae902ab03c1f6ff5375ce52e2a53e898ed43
SSDEEP

24576:TW/3PdLkrzHBV8svBMMzcxDyV/hik5gbelLbslQjui0jIGBI:TOVLknHj8svVcOck5/Mbi0I

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012252-7.dat	DanabotLoader2021
behavioral1/memory/2496-12-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021
behavioral1/memory/2496-14-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021
behavioral1/memory/2496-22-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021
behavioral1/memory/2496-23-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021
behavioral1/memory/2496-24-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021
behavioral1/memory/2496-25-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021
behavioral1/memory/2496-26-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021
behavioral1/memory/2496-27-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021
behavioral1/memory/2496-28-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021
behavioral1/memory/2496-29-0x0000000002110000-0x0000000002271000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2496	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
2496	rundll32.exe
2496	rundll32.exe
2496	rundll32.exe
2496	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2496	2312	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	28
PID 2312 wrote to memory of 2496	2312	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	28
PID 2312 wrote to memory of 2496	2312	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	28
PID 2312 wrote to memory of 2496	2312	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	28
PID 2312 wrote to memory of 2496	2312	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	28
PID 2312 wrote to memory of 2496	2312	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	28
PID 2312 wrote to memory of 2496	2312	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2645AF~1.DLL,s C:\Users\Admin\AppData\Local\Temp\2645AF~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2645AF~1.DLL

Filesize
1.3MB

MD5
9d499a1079b0fc902a56b978fd87624e

SHA1
93e7998634f2583e84b3f5b20cb0e284482aee8d

SHA256
9d09c3ac702b0a6d40c607e1d3850f87753086b6282c180240821d804508419a

SHA512
df24e71c217985aa85c053bf9f3f28ac6ab7028d7ccfc81740f4a6e1e2c938a9ea0ee3c94d7de10a87b7404915a2fb2a5b3ec0c27ca2adf6b06b09b550850a97

Download Submit
memory/2312-0-0x0000000000B70000-0x0000000000C5E000-memory.dmp

Filesize
952KB

Download
memory/2312-2-0x0000000000C60000-0x0000000000D65000-memory.dmp

Filesize
1.0MB

Download
memory/2312-1-0x0000000000B70000-0x0000000000C5E000-memory.dmp

Filesize
952KB

Download
memory/2312-3-0x0000000000400000-0x0000000000950000-memory.dmp

Filesize
5.3MB

Download
memory/2312-6-0x0000000000400000-0x0000000000950000-memory.dmp

Filesize
5.3MB

Download
memory/2312-13-0x0000000000C60000-0x0000000000D65000-memory.dmp

Filesize
1.0MB

Download
memory/2496-14-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download
memory/2496-12-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download
memory/2496-22-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download
memory/2496-23-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download
memory/2496-24-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download
memory/2496-25-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download
memory/2496-26-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download
memory/2496-27-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download
memory/2496-28-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download
memory/2496-29-0x0000000002110000-0x0000000002271000-memory.dmp

Filesize
1.4MB

Download