danabot | 233df04bc2ee124e7af1399d77450d7db5985ce99defde5ce0604d592bfffc77

General

Target

d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe
Size

1.1MB
MD5

d21dcfd40ce6dd227a6a7447fc11544f
SHA1

2214970e6a571f49f94c456ac755018fa3f81985
SHA256

233df04bc2ee124e7af1399d77450d7db5985ce99defde5ce0604d592bfffc77
SHA512

9edd6afa0ad0e94769bce5b5de6297ac5ba140b861662113ff1a52976a91ef6382f6d8e1efabbf56b34b6da122e0269b37363eb263d196c1b6c7a35d64009bc2
SSDEEP

24576:yq4oCe5k1qVHBoHUkIjHipP+EtXldQz+iZlhB0H8b:D4J3mHaTmEpld6zlg

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000c000000012339-8.dat	DanabotLoader2021
behavioral1/memory/2728-13-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021
behavioral1/memory/2728-14-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021
behavioral1/memory/2728-22-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021
behavioral1/memory/2728-23-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021
behavioral1/memory/2728-24-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021
behavioral1/memory/2728-25-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021
behavioral1/memory/2728-26-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021
behavioral1/memory/2728-27-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021
behavioral1/memory/2728-28-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021
behavioral1/memory/2728-29-0x0000000001E80000-0x0000000001FE0000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2728	rundll32.exe

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid	Process
2728	rundll32.exe
2728	rundll32.exe
2728	rundll32.exe
2728	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2292 wrote to memory of 2728	2292	d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2728	2292	d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2728	2292	d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2728	2292	d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2728	2292	d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2728	2292	d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2728	2292	d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\D21DCF~1.DLL,s C:\Users\Admin\AppData\Local\Temp\D21DCF~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D21DCF~1.DLL

Filesize
1.3MB

MD5
df4f9b12875fc6a6d3979c43e20e76a9

SHA1
45a612b5757db03552d1d7753a5ef65b191fcbd5

SHA256
63a5ecf104d70cbc6881678a967002055a2f84a5954a4a7e4e4bac50a8fd35d0

SHA512
a74c0275dea1f05cabe9d6c91932db231e398fa7c06d8f378f8b566bb9841a92c361ba2f3582cc7c7dac54d07ff9af7ef6e61143f05d72163ca9dc60c86304c7

Download Submit
memory/2292-0-0x0000000000530000-0x000000000061D000-memory.dmp

Filesize
948KB

Download
memory/2292-2-0x0000000000700000-0x0000000000805000-memory.dmp

Filesize
1.0MB

Download
memory/2292-1-0x0000000000530000-0x000000000061D000-memory.dmp

Filesize
948KB

Download
memory/2292-3-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/2292-6-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/2292-7-0x0000000000700000-0x0000000000805000-memory.dmp

Filesize
1.0MB

Download
memory/2728-14-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download
memory/2728-13-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download
memory/2728-22-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download
memory/2728-23-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download
memory/2728-24-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download
memory/2728-25-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download
memory/2728-26-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download
memory/2728-27-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download
memory/2728-28-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download
memory/2728-29-0x0000000001E80000-0x0000000001FE0000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads