danabot | b13a39af4ec228e24e9dec94878cb4f84b99818810c25d3f4f9c0ebda94783fa

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 16:24

Target

edd988205ba5cd316b4321a77d5811d3_JaffaCakes118.dll
Size

1.3MB
MD5

edd988205ba5cd316b4321a77d5811d3
SHA1

7a023b0bc5cb613307c97bca673d6422569762ba
SHA256

b13a39af4ec228e24e9dec94878cb4f84b99818810c25d3f4f9c0ebda94783fa
SHA512

0b8cf0b8866fd51ad039fc43b7ae69e91a0d183104baf03a99d5dc75f3d4dfcd152f5b94ace5600ae9e6c5d229a52ee48e5f930971e727ac193ac10d5be7f985
SSDEEP

24576:a8FPiO/eO4ES4b5aRyYhQv54aMsFhAF9ATmwMPGA:BRtRb5R4vsA9ATFMP

Score

10^/10

Family

danabot

Botnet

192.52.166.169:443

173.254.204.95:443

192.52.167.45:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2212-0-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-1-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-2-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-3-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-4-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-5-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-6-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-7-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-8-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-9-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-10-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-11-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-12-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-13-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021
behavioral1/memory/2212-14-0x00000000004B0000-0x000000000060D000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2212	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1708 wrote to memory of 2212	1708	rundll32.exe	28
PID 1708 wrote to memory of 2212	1708	rundll32.exe	28
PID 1708 wrote to memory of 2212	1708	rundll32.exe	28
PID 1708 wrote to memory of 2212	1708	rundll32.exe	28
PID 1708 wrote to memory of 2212	1708	rundll32.exe	28
PID 1708 wrote to memory of 2212	1708	rundll32.exe	28
PID 1708 wrote to memory of 2212	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\edd988205ba5cd316b4321a77d5811d3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\edd988205ba5cd316b4321a77d5811d3_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2212

memory/2212-0-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-1-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-2-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-3-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-4-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-5-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-6-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-7-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-8-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-9-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-10-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-11-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-12-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-13-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download
memory/2212-14-0x00000000004B0000-0x000000000060D000-memory.dmp

Filesize
1.4MB

Download