danabot | 5d953ea0f46ddf9a1994a405824a464f557e81d502967f96b502984d5299db1a

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 12:48

Target

e77f7b71ab659882440748c0e10848fd_JaffaCakes118.dll
Size

1.3MB
MD5

e77f7b71ab659882440748c0e10848fd
SHA1

2646ac7ff84afbe1f96d7392d625782faf3276a8
SHA256

5d953ea0f46ddf9a1994a405824a464f557e81d502967f96b502984d5299db1a
SHA512

193765da81ccd24c8fdc033e116b01be5f788421e2d166f7b9845a128894a73fe5650e96684385a6fa3338f4b817d35acbf07b0dc5f5062272922914a79c875d
SSDEEP

24576:1cF2ra/zQLMP0acay4WiKuZJGC8nwiTd1v1:21WibZxiT/

Score

10^/10

Family

danabot

Botnet

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2368-0-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-1-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-2-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-3-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-4-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-5-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-6-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-7-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-8-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-9-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-10-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-11-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-12-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-13-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021
behavioral1/memory/2368-14-0x00000000007B0000-0x0000000000911000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2368	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28
PID 1440 wrote to memory of 2368	1440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e77f7b71ab659882440748c0e10848fd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e77f7b71ab659882440748c0e10848fd_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2368

memory/2368-0-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-1-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-2-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-3-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-4-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-5-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-6-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-7-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-8-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-9-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-10-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-11-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-12-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-13-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download
memory/2368-14-0x00000000007B0000-0x0000000000911000-memory.dmp

Filesize
1.4MB

Download