danabot | 2b9e8951415452e32f4c7234e587cc9b56a003fdad074752c1f4f0270f652719

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 00:59

Target

f252f324c4b7890a40a9b022070ecf4e_JaffaCakes118.dll
Size

1.3MB
MD5

f252f324c4b7890a40a9b022070ecf4e
SHA1

0bb5dfb660c0422e1036c5c9905d1b3bd7601fa1
SHA256

2b9e8951415452e32f4c7234e587cc9b56a003fdad074752c1f4f0270f652719
SHA512

e72cc8ffaccc16a467a779fea6be26f0590d39d86765ed77cc2f41dd271a2e7c3cb50416a2bd2c2427bf30c5d277a2b777a0b00b1b9b3a0bfcfa423f85d0ee4c
SSDEEP

24576:ccF2J0m0JK+8sovEKeGvACuCgoDbPYqzL2qO4TTuMCJ:faOGvAbfoXXL/T2J

Score

10^/10

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2184-0-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-1-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-2-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-3-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-4-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-5-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-6-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-7-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-8-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-9-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-10-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-11-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-12-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-13-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021
behavioral1/memory/2184-14-0x0000000001EE0000-0x0000000002041000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2184	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1064 wrote to memory of 2184	1064	rundll32.exe	28
PID 1064 wrote to memory of 2184	1064	rundll32.exe	28
PID 1064 wrote to memory of 2184	1064	rundll32.exe	28
PID 1064 wrote to memory of 2184	1064	rundll32.exe	28
PID 1064 wrote to memory of 2184	1064	rundll32.exe	28
PID 1064 wrote to memory of 2184	1064	rundll32.exe	28
PID 1064 wrote to memory of 2184	1064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f252f324c4b7890a40a9b022070ecf4e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f252f324c4b7890a40a9b022070ecf4e_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2184

memory/2184-0-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-1-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-2-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-3-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-4-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-5-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-6-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-7-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-8-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-9-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-10-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-11-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-12-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-13-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download
memory/2184-14-0x0000000001EE0000-0x0000000002041000-memory.dmp

Filesize
1.4MB

Download