danabot | 3fde70aec3497bc38df7518fcf190ae5ebbdd8c85976c28a17f7a43eaac9e92b

Analysis

max time kernel
150s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 18:32

Target

ee13cc90fabfc6ac9c4e8a00ed3805af_JaffaCakes118.dll
Size

1.3MB
MD5

ee13cc90fabfc6ac9c4e8a00ed3805af
SHA1

b50098d0e99a9f0f88624e58701c1a9570e421ae
SHA256

3fde70aec3497bc38df7518fcf190ae5ebbdd8c85976c28a17f7a43eaac9e92b
SHA512

5d0523bb8753f9bb6043df3d3e62cb0e479581e48b41efd86bc2a2c99c98654f5fcf36aa3366fbf8c30739296269b5b48b1d4d81a364d862e540fe7204ed4537
SSDEEP

24576:1cFPyo6btoASOimlkWOD+DmKj5kjsfSPdITDjPpwbz:2WkPEj5kw6STvPp

Score

10^/10

Family

danabot

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2736-0-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-1-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-2-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-3-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-4-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-5-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-6-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-7-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-8-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-9-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-10-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-11-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-12-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-13-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021
behavioral1/memory/2736-14-0x0000000001D80000-0x0000000001EDF000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2736	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2408 wrote to memory of 2736	2408	rundll32.exe	28
PID 2408 wrote to memory of 2736	2408	rundll32.exe	28
PID 2408 wrote to memory of 2736	2408	rundll32.exe	28
PID 2408 wrote to memory of 2736	2408	rundll32.exe	28
PID 2408 wrote to memory of 2736	2408	rundll32.exe	28
PID 2408 wrote to memory of 2736	2408	rundll32.exe	28
PID 2408 wrote to memory of 2736	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee13cc90fabfc6ac9c4e8a00ed3805af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee13cc90fabfc6ac9c4e8a00ed3805af_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2736

memory/2736-0-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-1-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-2-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-3-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-4-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-5-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-6-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-7-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-8-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-9-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-10-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-11-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-12-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-13-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download
memory/2736-14-0x0000000001D80000-0x0000000001EDF000-memory.dmp

Filesize
1.4MB

Download