danabot | 5223dfd0625f9c0185149d5c96ea355822e3751c5e67d1eca48635314512930d

General

Target

f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe
Size

1.1MB
MD5

f14cfde4054c340f845dc94a40092bf2
SHA1

d6e10af1081eaa0521b8dff0c3a387376d61ef4a
SHA256

5223dfd0625f9c0185149d5c96ea355822e3751c5e67d1eca48635314512930d
SHA512

77d41ee40dbb9d12892ada290b3732089dd2f8f8365362295639af6b926677d379da46a7620575ffe663c840c90c4226574c3665f502fadaa2d04a154840b5a4
SSDEEP

24576:FCOMrdnKc/00Tk5/PnZnoa/eHCWAs2d+P9uVci5sppJgo:YZZ/163KtHCf+YK

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

Processes:

resource	yara_rule
behavioral1/memory/320-12-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021
behavioral1/files/0x00090000000122be-11.dat	DanabotLoader2021
behavioral1/memory/320-14-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021
behavioral1/memory/320-22-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021
behavioral1/memory/320-23-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021
behavioral1/memory/320-24-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021
behavioral1/memory/320-25-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021
behavioral1/memory/320-26-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021
behavioral1/memory/320-27-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021
behavioral1/memory/320-28-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021
behavioral1/memory/320-29-0x0000000001FE0000-0x0000000002142000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	320	rundll32.exe

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid	Process
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1512 wrote to memory of 320	1512	f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe	28
PID 1512 wrote to memory of 320	1512	f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe	28
PID 1512 wrote to memory of 320	1512	f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe	28
PID 1512 wrote to memory of 320	1512	f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe	28
PID 1512 wrote to memory of 320	1512	f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe	28
PID 1512 wrote to memory of 320	1512	f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe	28
PID 1512 wrote to memory of 320	1512	f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f14cfde4054c340f845dc94a40092bf2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\F14CFD~1.DLL,s C:\Users\Admin\AppData\Local\Temp\F14CFD~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\F14CFD~1.DLL

Filesize
1.3MB

MD5
680f8287a843c3d947946016bd71d8c2

SHA1
453a61211700a615a8461f3cda5c9d44acd64504

SHA256
b022d01fdce1044ff61a3685b25bb2e67da16e41adfcc2e6536a39fb5444d659

SHA512
8ee2c024d09f569799ea17d5e73d52da01ad47e179d988faea5e81905b543c3c0789b6396290fa1cae5df0de09aa1e7bbbe49d5f6bcd32f9e995e9a16588b783

Download Submit
memory/320-25-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/320-24-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/320-29-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/320-28-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/320-22-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/320-27-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/320-26-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/320-14-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/320-12-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/320-23-0x0000000001FE0000-0x0000000002142000-memory.dmp

Filesize
1.4MB

Download
memory/1512-13-0x00000000020C0000-0x00000000021C5000-memory.dmp

Filesize
1.0MB

Download
memory/1512-0-0x0000000001FD0000-0x00000000020BE000-memory.dmp

Filesize
952KB

Download
memory/1512-2-0x00000000020C0000-0x00000000021C5000-memory.dmp

Filesize
1.0MB

Download
memory/1512-1-0x0000000001FD0000-0x00000000020BE000-memory.dmp

Filesize
952KB

Download
memory/1512-6-0x0000000000400000-0x000000000084F000-memory.dmp

Filesize
4.3MB

Download
memory/1512-3-0x0000000000400000-0x000000000084F000-memory.dmp

Filesize
4.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads