danabot | f0e1b3c8a2f25d686a1a7bb61a28708555194eb200ebc476b2e005f4cddd3d47

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 00:41

Target

657716d18ecf60e5cc06ff786970fe84_JaffaCakes118.dll
Size

1.3MB
MD5

657716d18ecf60e5cc06ff786970fe84
SHA1

5428b156691f26f588a00aabf3bc524f7141ed41
SHA256

f0e1b3c8a2f25d686a1a7bb61a28708555194eb200ebc476b2e005f4cddd3d47
SHA512

019d6e1ae12a6c00132a17b5e93380bcd90192d655932e75517042ede542480c3be1a150088c74f06cbf013fbb0cb3684c1445f7a5f4f7e5783c6cc5678de4d9
SSDEEP

24576:b8pWEmAojqMO2dYmcO/yWltt4XLa/uYFTlc:ALMLPtti4fFTK

Score

10^/10

Family

danabot

Botnet

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes

rsa_pubkey.plain

rsa_privkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2852-0-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-1-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-2-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-3-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-4-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-5-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-6-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-7-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-8-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-9-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-10-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-11-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-12-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-13-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021
behavioral1/memory/2852-14-0x0000000000450000-0x00000000005B2000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
2	2852	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2928 wrote to memory of 2852	2928	rundll32.exe	30
PID 2928 wrote to memory of 2852	2928	rundll32.exe	30
PID 2928 wrote to memory of 2852	2928	rundll32.exe	30
PID 2928 wrote to memory of 2852	2928	rundll32.exe	30
PID 2928 wrote to memory of 2852	2928	rundll32.exe	30
PID 2928 wrote to memory of 2852	2928	rundll32.exe	30
PID 2928 wrote to memory of 2852	2928	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\657716d18ecf60e5cc06ff786970fe84_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\657716d18ecf60e5cc06ff786970fe84_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2852

memory/2852-0-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-1-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-2-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-3-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-4-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-5-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-6-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-7-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-8-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-9-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-10-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-11-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-12-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-13-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download
memory/2852-14-0x0000000000450000-0x00000000005B2000-memory.dmp

Filesize
1.4MB

Download