danabot | 3fde70aec3497bc38df7518fcf190ae5ebbdd8c85976c28a17f7a43eaac9e92b

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 18:32

Target

ee13cc90fabfc6ac9c4e8a00ed3805af_JaffaCakes118.dll
Size

1.3MB
MD5

ee13cc90fabfc6ac9c4e8a00ed3805af
SHA1

b50098d0e99a9f0f88624e58701c1a9570e421ae
SHA256

3fde70aec3497bc38df7518fcf190ae5ebbdd8c85976c28a17f7a43eaac9e92b
SHA512

5d0523bb8753f9bb6043df3d3e62cb0e479581e48b41efd86bc2a2c99c98654f5fcf36aa3366fbf8c30739296269b5b48b1d4d81a364d862e540fe7204ed4537
SSDEEP

24576:1cFPyo6btoASOimlkWOD+DmKj5kjsfSPdITDjPpwbz:2WkPEj5kw6STvPp

Score

10^/10

Family

danabot

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 14 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1404-0-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-1-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-2-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-3-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-4-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-5-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-6-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-7-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-8-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-9-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-10-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-11-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-12-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021
behavioral2/memory/1404-13-0x0000000000400000-0x000000000055F000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
7	1404	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 760 wrote to memory of 1404	760	rundll32.exe	93
PID 760 wrote to memory of 1404	760	rundll32.exe	93
PID 760 wrote to memory of 1404	760	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee13cc90fabfc6ac9c4e8a00ed3805af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee13cc90fabfc6ac9c4e8a00ed3805af_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:4312

memory/1404-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-1-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-2-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-3-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-4-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-5-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-6-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-7-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-8-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-9-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-10-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-11-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-12-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1404-13-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download