danabot | 40620ee4884dd5f585c7d8286bda375535af329154ec44e5826ac84e9716156e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fdc145d46403a4ab4f3c271038e9b71a_JaffaCakes118.dll
Size 1.3MB
Sample240420-12c4csbb79
SHA256 40620ee4884dd5f585c7d8286bda375535af329154ec44e5826ac84e9716156e
MD5 fdc145d46403a4ab4f3c271038e9b71a
SHA1 265116608b06a2926e54c76044a78493e81ba5dc
SHA512 60f08391a725392538870559550118c5eea0b3b871052e0dae3b95e9f592e595a1c6b054b72def306ce6ea907dcb86ede04b7e6e0c0b4d356e085bc192c19ff2
SSDEEP 24576:lcF2L9dT0secg4cOeMDBj2Zsrm0Ty0zjPTzK:GyjFjMTe3Tu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.242.31:443
192.119.110.73:443
192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

resource	yara_rule
behavioral2/memory/5024-0-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021
behavioral2/memory/5024-1-0x0000000000400000-0x0000000000561000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	5024	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 5024	3980	rundll32.exe	85
PID 3980 wrote to memory of 5024	3980	rundll32.exe	85
PID 3980 wrote to memory of 5024	3980	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdc145d46403a4ab4f3c271038e9b71a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdc145d46403a4ab4f3c271038e9b71a_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:5024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5024-0-0x0000000000400000-0x0000000000561000-memory.dmp

Download

memory/5024-1-0x0000000000400000-0x0000000000561000-memory.dmp