danabot | 6ebbc1b9edb101e23b574745b7a3973f6d29209bc53082486b2e76092b647fbe

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 02:46

Target

e909268babd8038ecfba09759ce45fbe_JaffaCakes118.dll
Size

1.3MB
MD5

e909268babd8038ecfba09759ce45fbe
SHA1

c32c85993a51dc0273ab0565904e79a5561364f8
SHA256

6ebbc1b9edb101e23b574745b7a3973f6d29209bc53082486b2e76092b647fbe
SHA512

a8941f8d0bae7860a001aa0d1e2b16580773c7cd19d7da413042600dd122a16a5d1967c39cafc76a0489bb91ef9412729ae2efb5e3464b49953809aab5ec2c16
SSDEEP

24576:kcF2VtrZmrDEtLk7Kd/FFdf+BawXHvJbSc9W0wTR7McbtV:HzyFJ+3Sc9W0wT5Mo

Score

10^/10

Family

danabot

Botnet

5.9.224.204:443

192.210.222.81:443

23.229.29.48:443

Attributes

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

resource	yara_rule
behavioral1/memory/3000-0-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-1-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-2-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-3-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-4-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-5-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-6-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-7-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-8-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-9-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-10-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-11-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-12-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-13-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021
behavioral1/memory/3000-14-0x0000000000430000-0x0000000000591000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	3000	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3000	1984	rundll32.exe	28
PID 1984 wrote to memory of 3000	1984	rundll32.exe	28
PID 1984 wrote to memory of 3000	1984	rundll32.exe	28
PID 1984 wrote to memory of 3000	1984	rundll32.exe	28
PID 1984 wrote to memory of 3000	1984	rundll32.exe	28
PID 1984 wrote to memory of 3000	1984	rundll32.exe	28
PID 1984 wrote to memory of 3000	1984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e909268babd8038ecfba09759ce45fbe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e909268babd8038ecfba09759ce45fbe_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3000

memory/3000-0-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-1-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-2-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-3-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-4-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-5-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-6-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-7-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-8-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-9-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-10-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-11-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-12-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-13-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download
memory/3000-14-0x0000000000430000-0x0000000000591000-memory.dmp

Filesize
1.4MB

Download