danabot | 40620ee4884dd5f585c7d8286bda375535af329154ec44e5826ac84e9716156e

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 22:08

Target

fdc145d46403a4ab4f3c271038e9b71a_JaffaCakes118.dll
Size

1.3MB
MD5

fdc145d46403a4ab4f3c271038e9b71a
SHA1

265116608b06a2926e54c76044a78493e81ba5dc
SHA256

40620ee4884dd5f585c7d8286bda375535af329154ec44e5826ac84e9716156e
SHA512

60f08391a725392538870559550118c5eea0b3b871052e0dae3b95e9f592e595a1c6b054b72def306ce6ea907dcb86ede04b7e6e0c0b4d356e085bc192c19ff2
SSDEEP

24576:lcF2L9dT0secg4cOeMDBj2Zsrm0Ty0zjPTzK:GyjFjMTe3Tu

Score

10^/10

Family

danabot

Botnet

142.11.242.31:443

192.119.110.73:443

192.210.222.88:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2956-0-0x0000000001F70000-0x00000000020D1000-memory.dmp	DanabotLoader2021
behavioral1/memory/2956-1-0x0000000001F70000-0x00000000020D1000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2956	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 844 wrote to memory of 2956	844	rundll32.exe	28
PID 844 wrote to memory of 2956	844	rundll32.exe	28
PID 844 wrote to memory of 2956	844	rundll32.exe	28
PID 844 wrote to memory of 2956	844	rundll32.exe	28
PID 844 wrote to memory of 2956	844	rundll32.exe	28
PID 844 wrote to memory of 2956	844	rundll32.exe	28
PID 844 wrote to memory of 2956	844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdc145d46403a4ab4f3c271038e9b71a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdc145d46403a4ab4f3c271038e9b71a_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2956

memory/2956-0-0x0000000001F70000-0x00000000020D1000-memory.dmp

Filesize
1.4MB

Download
memory/2956-1-0x0000000001F70000-0x00000000020D1000-memory.dmp

Filesize
1.4MB

Download