danabot | 9c31218c842d4365ab2211ddd032cfab90b661f4fed1a4fe9380b1a4179b5cff

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 01:27

Target
498771bee3b953ca644488dae7cf7f80_JaffaCakes118.dll
Size 1.3MB
Sample240331-bvjvwsbc8s
SHA256 9c31218c842d4365ab2211ddd032cfab90b661f4fed1a4fe9380b1a4179b5cff
MD5 498771bee3b953ca644488dae7cf7f80
SHA1 0b9a2b1050e6404c59cc10ba4dcd8f26a130614c
SHA512 2bd96af594344f91d66adc148979c592e98967579bf04601ad7356efae694b849c0f779e95aa3de14fa21c83e49207296b7fd511291d33d5b39bde1c025ba660
SSDEEP 24576:58FG/L98qXKTVfl8B0Y1ewAfj3xCV2D3qyzATrQB79t:a7VSNAfj3xCoayzAT0j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 1 IoCs

resource	yara_rule
behavioral2/memory/3276-0-0x0000000000400000-0x0000000000560000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	3276	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3276	4004	rundll32.exe	85
PID 4004 wrote to memory of 3276	4004	rundll32.exe	85
PID 4004 wrote to memory of 3276	4004	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\498771bee3b953ca644488dae7cf7f80_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\498771bee3b953ca644488dae7cf7f80_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3276

memory/3276-0-0x0000000000400000-0x0000000000560000-memory.dmp

Download