danabot | 5d6bcdce1b0303397d00511cc64c6d2a26f94e5bef67990afa161575b7ea5038

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 21:48

Target

f6a4b5eae090b0b2f60d81f8996d87a1_JaffaCakes118.dll
Size

1.4MB
MD5

f6a4b5eae090b0b2f60d81f8996d87a1
SHA1

878f35b314e5e3dc2de42b61a191748cc57e2414
SHA256

5d6bcdce1b0303397d00511cc64c6d2a26f94e5bef67990afa161575b7ea5038
SHA512

c4e3a9e311ff613c2668cbe65ac065e88999c17539630066dec9f748e1926e5632c13e5408fb8edbac6f7665b6994855706aad7c41c16799dbabc12a6ee44ab5
SSDEEP

24576:qu9eaOAfo5oV3aNJ6V5sniG+LVzJEqiF9PTRwl5Px:XfbV5sihVNheTQRx

Score

10^/10

Family

danabot

Botnet

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1852-0-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-1-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-2-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-3-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-4-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-5-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-6-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-7-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-8-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-9-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-10-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-11-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-12-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-13-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021
behavioral1/memory/1852-14-0x0000000000B20000-0x0000000000C86000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	1852	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2004 wrote to memory of 1852	2004	rundll32.exe	28
PID 2004 wrote to memory of 1852	2004	rundll32.exe	28
PID 2004 wrote to memory of 1852	2004	rundll32.exe	28
PID 2004 wrote to memory of 1852	2004	rundll32.exe	28
PID 2004 wrote to memory of 1852	2004	rundll32.exe	28
PID 2004 wrote to memory of 1852	2004	rundll32.exe	28
PID 2004 wrote to memory of 1852	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a4b5eae090b0b2f60d81f8996d87a1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a4b5eae090b0b2f60d81f8996d87a1_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1852

memory/1852-0-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-1-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-2-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-3-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-4-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-5-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-6-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-7-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-8-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-9-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-10-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-11-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-12-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-13-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download
memory/1852-14-0x0000000000B20000-0x0000000000C86000-memory.dmp

Filesize
1.4MB

Download