danabot | 910a3ea5bf49de9ba90a34c36825736573c3ab5bff42b4c74acd0d01944a0749

General

Target

e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe
Size

1.2MB
MD5

e3b13460d5a2b360aa335350df31fcab
SHA1

dbc31a57826c47b1614dcb24e0bf7a08fbece938
SHA256

910a3ea5bf49de9ba90a34c36825736573c3ab5bff42b4c74acd0d01944a0749
SHA512

54fb9ca88193d589b111d548ca6d09bbb92805a95ee994fb8979f0a42ed9e15059d13af5ae45eed7601b9702518a1efc697dbc9d17368782ef4c037426c1be96
SSDEEP

24576:1gP+l4e7VuPkXcLN7vQLPR0xUbfdAfI13Q/n0ba47HrbKPqs:CPK7Vuh747RAUbCwl8Ia47LbU

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000c00000001224f-7.dat	DanabotLoader2021
behavioral1/memory/2532-12-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/2532-13-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/2532-21-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/2532-22-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/2532-23-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/2532-24-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/2532-25-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/2532-26-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/2532-27-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021
behavioral1/memory/2532-28-0x0000000002020000-0x0000000002182000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2532	rundll32.exe

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid	Process
2532	rundll32.exe
2532	rundll32.exe
2532	rundll32.exe
2532	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1996 wrote to memory of 2532	1996	e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe	28
PID 1996 wrote to memory of 2532	1996	e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe	28
PID 1996 wrote to memory of 2532	1996	e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe	28
PID 1996 wrote to memory of 2532	1996	e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe	28
PID 1996 wrote to memory of 2532	1996	e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe	28
PID 1996 wrote to memory of 2532	1996	e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe	28
PID 1996 wrote to memory of 2532	1996	e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3b13460d5a2b360aa335350df31fcab_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\E3B134~1.DLL,s C:\Users\Admin\AppData\Local\Temp\E3B134~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E3B134~1.DLL

Filesize
1.3MB

MD5
4cf366efc21485c8dd7ab1e9438cc5ea

SHA1
05262ccfdf41abacb741458ceafc58f11658c65b

SHA256
b39d1b4e25b3b12daa3c82fd05267a9cadb7dc7cee0efa9bbd9ce6c9b6c53d28

SHA512
e6303f7b938bf06d0232e5c1bbc86a381b6d1841c44944895c52a7a0920c3463686af76bc9e500799ed66727ab5852719dc4b92625b2236307f3c2031753ebec

Download Submit
memory/1996-0-0x0000000000220000-0x000000000030F000-memory.dmp

Filesize
956KB

Download
memory/1996-1-0x0000000000220000-0x000000000030F000-memory.dmp

Filesize
956KB

Download
memory/1996-2-0x00000000017A0000-0x00000000018A6000-memory.dmp

Filesize
1.0MB

Download
memory/1996-3-0x0000000000400000-0x00000000017A0000-memory.dmp

Filesize
19.6MB

Download
memory/1996-6-0x0000000000400000-0x00000000017A0000-memory.dmp

Filesize
19.6MB

Download
memory/2532-21-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/2532-13-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/2532-12-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/2532-22-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/2532-23-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/2532-24-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/2532-25-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/2532-26-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/2532-27-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download
memory/2532-28-0x0000000002020000-0x0000000002182000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads