danabot | c6b70d184339d61b7a42f0c189cadb0b22b3ebec18b194b7e5a334a9006d3aed

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-04-2024 18:43

Target

e59b006e2fffda4d0cc7d8c185cd2c19_JaffaCakes118.dll
Size

1.3MB
MD5

e59b006e2fffda4d0cc7d8c185cd2c19
SHA1

259e929ac08f2aea90ef45b5a28b3cf57a7ddc97
SHA256

c6b70d184339d61b7a42f0c189cadb0b22b3ebec18b194b7e5a334a9006d3aed
SHA512

1f9165146f80d3b01271708f5850528496c3b8ae8556d6eeb2dc8c04b4e969773bb16334f4087a8955913c2cbacf98c5c70010fd2e31ca7e7d56ba6ee5471d3d
SSDEEP

24576:L8pWEmDXswcrLEEcQ1fObM5HqTgNmsBdyTWnrO:QtSzeTBdyTq

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2832 rundll32.exe

flow	pid	process
2	2832	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1800 wrote to memory of 2832	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2832	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2832	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2832	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2832	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2832	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2832	1800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e59b006e2fffda4d0cc7d8c185cd2c19_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e59b006e2fffda4d0cc7d8c185cd2c19_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:2832

memory/2832-0-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-1-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-2-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-3-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-4-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-5-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-6-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-7-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-8-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-9-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-10-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-11-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-12-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-13-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download
memory/2832-14-0x0000000002140000-0x00000000022A2000-memory.dmp

Filesize
1.4MB

Download