danabot | d7ba71505cb245cf7f24e533bf20118d7c50c206ec8c907f66a84bb32b8c3d24

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe
Size

1.1MB
MD5

f667382190dc62fe9f06aaec42f12d8b
SHA1

b239a2cc9964e0ed2606ebd2597e5382f1bd7f27
SHA256

d7ba71505cb245cf7f24e533bf20118d7c50c206ec8c907f66a84bb32b8c3d24
SHA512

62fea081d3c6b0a9e1d354025d03f5dc67aa782f34db9b80f5a9f66a9b89d0651d007c301a66b5617bd5682322b998cf017e89acb9006cbe1b4fbbed3ca0978e
SSDEEP

24576:HhYEzdB1MLwtSvyQZrIE9dbSwWwigNz46s5swWG9T5eABq:HrB1TAvyQZsE7SgNznsVW0EAY

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

embedded_hash
0E1A7A1479C37094441FA911262B322A
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 5 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000c00000001224c-14.dat	DanabotLoader2021
behavioral1/memory/2772-19-0x00000000009C0000-0x0000000000B20000-memory.dmp	DanabotLoader2021
behavioral1/memory/2772-21-0x00000000009C0000-0x0000000000B20000-memory.dmp	DanabotLoader2021
behavioral1/memory/2772-34-0x00000000009C0000-0x0000000000B20000-memory.dmp	DanabotLoader2021
behavioral1/memory/2772-35-0x00000000009C0000-0x0000000000B20000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2772	rundll32.exe

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid	Process
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1152 wrote to memory of 2772	1152	f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe	30
PID 1152 wrote to memory of 2772	1152	f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe	30
PID 1152 wrote to memory of 2772	1152	f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe	30
PID 1152 wrote to memory of 2772	1152	f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe	30
PID 1152 wrote to memory of 2772	1152	f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe	30
PID 1152 wrote to memory of 2772	1152	f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe	30
PID 1152 wrote to memory of 2772	1152	f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f667382190dc62fe9f06aaec42f12d8b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\F66738~1.DLL,s C:\Users\Admin\AppData\Local\Temp\F66738~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F66738~1.DLL

Filesize
1.3MB

MD5
4a67cabc912c677da01d3aac5ec96663

SHA1
72bbceb69e02ca3840fbe72abf186a24c49d3553

SHA256
db5170578a3fb127b36014960773e6348249151e788fe6cff64d88414511cede

SHA512
2dd536488036d420844170b3cd726d2b6cb11136f9968d74f6689ce18f1bada953eefece6d8f54c8777766e78f270d9894c95616340ffd703cd1126bc1908334

Download Submit
memory/1152-9-0x0000000003E20000-0x0000000003F23000-memory.dmp

Filesize
1.0MB

Download
memory/1152-2-0x0000000003E20000-0x0000000003F23000-memory.dmp

Filesize
1.0MB

Download
memory/1152-3-0x0000000000400000-0x000000000248C000-memory.dmp

Filesize
32.5MB

Download
memory/1152-6-0x0000000000400000-0x000000000248C000-memory.dmp

Filesize
32.5MB

Download
memory/1152-7-0x0000000003CE0000-0x0000000003DCD000-memory.dmp

Filesize
948KB

Download
memory/1152-0-0x0000000003CE0000-0x0000000003DCD000-memory.dmp

Filesize
948KB

Download
memory/1152-1-0x0000000003CE0000-0x0000000003DCD000-memory.dmp

Filesize
948KB

Download
memory/1152-20-0x0000000000400000-0x000000000248C000-memory.dmp

Filesize
32.5MB

Download
memory/1152-33-0x0000000000400000-0x000000000248C000-memory.dmp

Filesize
32.5MB

Download
memory/2772-19-0x00000000009C0000-0x0000000000B20000-memory.dmp

Filesize
1.4MB

Download
memory/2772-21-0x00000000009C0000-0x0000000000B20000-memory.dmp

Filesize
1.4MB

Download
memory/2772-34-0x00000000009C0000-0x0000000000B20000-memory.dmp

Filesize
1.4MB

Download
memory/2772-35-0x00000000009C0000-0x0000000000B20000-memory.dmp

Filesize
1.4MB

Download