danabot | 9b888370c999f0e75c96fd116747db225186b103ba72f450b7b80efb0df17905

General

Target

f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe
Size

1.2MB
MD5

f1d7d2229094f35ccfe456c25d4e68a4
SHA1

bda501dae1fd4fe02f3daaee76211879bfe28891
SHA256

9b888370c999f0e75c96fd116747db225186b103ba72f450b7b80efb0df17905
SHA512

886d58afd8ab258c847eff74234227066133b498e5298ed0975fc6e0726282f133fd6ff2960c886b299438a657a8a7bdfd1533ef3710b18945d847709df1e66e
SSDEEP

24576:Bkjz+3FjmyuI8tLRxbFPGhD+71Z+ZRCNvw69a6HwzD:BkXwptuI8tLfFPD718ZRVJw

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000d00000001225b-6.dat	DanabotLoader2021
behavioral1/memory/2600-12-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2600-14-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2600-22-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2600-23-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2600-24-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2600-25-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2600-26-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2600-27-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2600-28-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2600-29-0x0000000001D80000-0x0000000001EE1000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2600	rundll32.exe

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid	Process
2600	rundll32.exe
2600	rundll32.exe
2600	rundll32.exe
2600	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2332 wrote to memory of 2600	2332	f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2600	2332	f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2600	2332	f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2600	2332	f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2600	2332	f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2600	2332	f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2600	2332	f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1d7d2229094f35ccfe456c25d4e68a4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\F1D7D2~1.DLL,s C:\Users\Admin\AppData\Local\Temp\F1D7D2~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F1D7D2~1.DLL

Filesize
1.3MB

MD5
25b2c8d5e5634b0468d2a954be59ff95

SHA1
e3314a2397639874f047ad80463f0442561c7ae1

SHA256
d94ecb260334948de42c9382ed05f87c8aa155d18c901e597f8ab2c552f815eb

SHA512
4c9dd452277e0dcab8b81531947614e5d534f38af2b840bcfe7a92d9bfdc13f7dfff334f9a89894f2a7d9e718e87791a59ef0c46dcfa8bc835a0a07e3bedb3c5

Download Submit
memory/2332-13-0x0000000002E90000-0x0000000002F95000-memory.dmp

Filesize
1.0MB

Download
memory/2332-1-0x0000000000220000-0x000000000030E000-memory.dmp

Filesize
952KB

Download
memory/2332-2-0x0000000002E90000-0x0000000002F95000-memory.dmp

Filesize
1.0MB

Download
memory/2332-7-0x0000000000400000-0x0000000002E85000-memory.dmp

Filesize
42.5MB

Download
memory/2332-5-0x0000000000400000-0x0000000002E85000-memory.dmp

Filesize
42.5MB

Download
memory/2332-0-0x0000000000220000-0x000000000030E000-memory.dmp

Filesize
952KB

Download
memory/2600-14-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download
memory/2600-12-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download
memory/2600-22-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download
memory/2600-23-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download
memory/2600-24-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download
memory/2600-25-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download
memory/2600-26-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download
memory/2600-27-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download
memory/2600-28-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download
memory/2600-29-0x0000000001D80000-0x0000000001EE1000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads