danabot | 4fbb399e44f5e84cbc719d8e99028029adf60f524ebebab04d22513daf3bce9c

General

Target

a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe
Size

1.2MB
MD5

a77a0a1e3e245240b2f827d031ba4510
SHA1

6bfaeef8171e2f3b3d6d5abd9a7b02450ab22d42
SHA256

4fbb399e44f5e84cbc719d8e99028029adf60f524ebebab04d22513daf3bce9c
SHA512

332d42de83f2b6d7bb0410951ce7aff372b4133974a4909e6231d2fb8fb585987974b4491a393f54a6c87a63743e042e2321379d996b482f65eed7cec17c195a
SSDEEP

24576:J1VqL5OBAbNy307nscZDFigU1XJUJgfUR05G3E0tqN+TUx7cB44bYrhs3c:D4fs4sZgv325G3E0QNcK4bYrh

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\A77A0A~1.DLL	DanabotLoader2021
behavioral1/memory/3028-12-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/3028-13-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/3028-21-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/3028-22-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/3028-23-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/3028-24-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/3028-25-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/3028-26-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/3028-27-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/3028-28-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 3028 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

3028 rundll32.exe
3028 rundll32.exe
3028 rundll32.exe
3028 rundll32.exe

flow	pid	process
2	3028	rundll32.exe

pid	process
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe

description	pid	process	target process
PID 2956 wrote to memory of 3028	2956	a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe	rundll32.exe
PID 2956 wrote to memory of 3028	2956	a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe	rundll32.exe
PID 2956 wrote to memory of 3028	2956	a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe	rundll32.exe
PID 2956 wrote to memory of 3028	2956	a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe	rundll32.exe
PID 2956 wrote to memory of 3028	2956	a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe	rundll32.exe
PID 2956 wrote to memory of 3028	2956	a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe	rundll32.exe
PID 2956 wrote to memory of 3028	2956	a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a77a0a1e3e245240b2f827d031ba4510_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\A77A0A~1.DLL,s C:\Users\Admin\AppData\Local\Temp\A77A0A~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A77A0A~1.DLL
Filesize
1.3MB

MD5
fcf896855fc4296a8585965795675c7a

SHA1
1cfd30177ebfde2a5fdfd9f3a7e549e91c262964

SHA256
7699d6fa2baf65cd260b3abc2bae6d14bb6eec51c2066c732e4612accd06fc16

SHA512
b3360ecd3e1f7064bdfbb32f78b927b1d919e116e95f2f023daa96b5135b0115fd1c41035712b705bd32fadc089d83cd8ece8107622c54185634ae4239b4b027

Download Submit
memory/2956-0-0x00000000030D0000-0x00000000031BF000-memory.dmp

Filesize
956KB

Download
memory/2956-1-0x00000000030D0000-0x00000000031BF000-memory.dmp

Filesize
956KB

Download
memory/2956-2-0x00000000031C0000-0x00000000032C6000-memory.dmp

Filesize
1.0MB

Download
memory/2956-5-0x0000000000400000-0x00000000017A0000-memory.dmp

Filesize
19.6MB

Download
memory/2956-11-0x0000000000400000-0x00000000017A0000-memory.dmp

Filesize
19.6MB

Download
memory/3028-21-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/3028-13-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/3028-12-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/3028-22-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/3028-23-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/3028-24-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/3028-25-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/3028-26-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/3028-27-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/3028-28-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing