danabot | bd2cd1dde1a7bee943b5efafb2619bf9cec5f3892923edb1eff434e117380011

Analysis

max time kernel
142s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe
Size

1.1MB
MD5

2645af6d5f97b523b1ca99bea1c6406c
SHA1

f6f9ac3db5bf170ade1944acd274876a635200ae
SHA256

bd2cd1dde1a7bee943b5efafb2619bf9cec5f3892923edb1eff434e117380011
SHA512

1fc61092b4352f690abe22503ac6dc8258a4da94b1a953b678a0b74da92f2261f788b91c055ac0bd1edf12cd5e71ae902ab03c1f6ff5375ce52e2a53e898ed43
SSDEEP

24576:TW/3PdLkrzHBV8svBMMzcxDyV/hik5gbelLbslQjui0jIGBI:TOVLknHj8svVcOck5/Mbi0I

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 10 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023115-6.dat	DanabotLoader2021
behavioral2/memory/1448-10-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1448-18-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1448-19-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1448-20-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1448-21-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1448-22-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1448-23-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1448-24-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/1448-25-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
44	1448	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
1448	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	4168	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 1448	4168	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	88
PID 4168 wrote to memory of 1448	4168	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	88
PID 4168 wrote to memory of 1448	4168	2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2645af6d5f97b523b1ca99bea1c6406c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2645AF~1.DLL,s C:\Users\Admin\AppData\Local\Temp\2645AF~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 508
  2⤵
  - Program crash
  PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4168 -ip 4168
1⤵
PID:3272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2645AF~1.DLL

Filesize
1.3MB

MD5
fbae0d394a0d3278ef5493cdfb12584c

SHA1
aab319aff398ce6062e6142186b3683a96ae2841

SHA256
36567f46f22f2b7ba9367a8a31d4943ac85d66425ee48e8eb291ce5d7e0ad2ff

SHA512
3d0a549ad2fa6d235f2511283627831b76233db53d32d9f2a3ca24af31c0b65f2950bbb43a76328bb0dc7a93fe4887b12897d9c36b1e23c2a77d1cf1fd0ad534

Download Submit
memory/1448-10-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1448-22-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1448-25-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1448-24-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1448-23-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1448-21-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1448-18-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1448-19-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1448-20-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4168-1-0x0000000000C10000-0x0000000000D0E000-memory.dmp

Filesize
1016KB

Download
memory/4168-3-0x0000000000400000-0x0000000000950000-memory.dmp

Filesize
5.3MB

Download
memory/4168-9-0x0000000000D20000-0x0000000000E25000-memory.dmp

Filesize
1.0MB

Download
memory/4168-8-0x0000000000400000-0x0000000000950000-memory.dmp

Filesize
5.3MB

Download
memory/4168-2-0x0000000000D20000-0x0000000000E25000-memory.dmp

Filesize
1.0MB

Download