danabot | 0a38204354bdd03ca06520f5482cc057a926eef96944a2a179c370b9f64f4842

Analysis

max time kernel
142s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe
Size

847KB
MD5

7efdce6925f9d0a47262bf6909dee878
SHA1

c2675a34536fbb0e637b3b63ca5671f93a7f9484
SHA256

0a38204354bdd03ca06520f5482cc057a926eef96944a2a179c370b9f64f4842
SHA512

7f5ac9a34891642b056cd37c0f54c3cc86caab581df6a4d62d1279efe38449b0bc63bbd305eecaf382fadba7022c6791293711ec9855920dbf82a0a07347a80d
SSDEEP

24576:WbTUojyk1O/sDcxLx+gGBWDvKe0VR7Ev3b7YpQKZ445fm:gy7Gs78V9Ev3fYpvf

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

58.58.210.181

222.175.52.161

149.53.185.172

81.63.70.192

195.123.246.209

149.154.159.213

2.255.189.191

187.198.70.207

139.113.48.33

244.28.200.120

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x000a000000012280-2.dat	family_danabot

Blocklisted process makes network request 9 IoCs

flow	pid	Process
2	2304	rundll32.exe
3	2304	rundll32.exe
4	2304	rundll32.exe
5	2304	rundll32.exe
6	2304	rundll32.exe
9	2304	rundll32.exe
12	2304	rundll32.exe
15	2304	rundll32.exe
16	2304	rundll32.exe

Deletes itself 1 IoCs

pid	Process
2620	regsvr32.exe

Loads dropped DLL 5 IoCs

pid	Process
2620	regsvr32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	29
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	29
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	29
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	29
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	29
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	29
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	29
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	30
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	30
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	30
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	30
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	30
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	30
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	30

C:\Users\Admin\AppData\Local\Temp\7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\7EFDCE~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\7EFDCE~1.EXE@1612
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7EFDCE~1.DLL,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7EFDCE~1.DLL

Filesize
630KB

MD5
c7eb2bf31aff077a631dd3f03056286c

SHA1
76912c777b3e53b5a90be26d7a8792c9bc743a86

SHA256
b25936459bd7f0b8b0c8157e20841fbbf0115ac6d09132cfb22aadae763224f0

SHA512
6035ad5beb0b51fe400a156b6519b8e8c53886ad0833ee74673c22570ba8a3f443f1a82babe033e5aa6d5f8dfb1f50dde3f3b90b4a9bc0fc9c517bc1c7d1e8bd

Download Submit
memory/1612-1-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2304-8-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download
memory/2304-9-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download
memory/2304-11-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download
memory/2304-13-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download