danabot | af756a44f94d5084891d9fc3ee12c3d428e5337370c7ab7f07c7721d27738fd7

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
Size

1.2MB
MD5

6bc8466e6df854ba5b8cee8c1731f145
SHA1

e4a5e419e2f1c05a9531e1af6fac85b53eb8deeb
SHA256

af756a44f94d5084891d9fc3ee12c3d428e5337370c7ab7f07c7721d27738fd7
SHA512

d010f63e3d40b665a75f2860995f3257daede5c7fd1aee42e21d199b69a8af1999c611eb98e6448c7be8fe9047ddc07ce81f68bf8928635cda504ac4ba49f09a
SSDEEP

24576:0nZ+3tXsYjptSPJ1ABLRLEgX3bBRPSMS9ij4JWb+B36L:0nZ05setSR1qtLESR6MOiD+M

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2752	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
2752	rundll32.exe
2752	rundll32.exe
2752	rundll32.exe
2752	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	31
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	31
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	31
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	31
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	31
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	31
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6BC846~1.DLL,s C:\Users\Admin\AppData\Local\Temp\6BC846~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\6BC846~1.DLL

Filesize
1.3MB

MD5
c00ae3d536a74e22ddfaad8e2e76cb98

SHA1
a7ee4de67fb30ce482c9b74e2e909f9d495beda2

SHA256
c09a7963607553dc11ff59faf9cfc8d0aa528ce9ab07c8b573ae17ca2a00f059

SHA512
34f37ef1dc9a81cb3ddfe14c66e7a1a6cb8ebdbe25ec15cde8b89927fbcf48ab95ca23c5a31fcba89641b5c455d8c7bce3ca07db823ec77fc9f793ae1e53c2fc

Download Submit
memory/2748-1-0x0000000000220000-0x0000000000310000-memory.dmp

Filesize
960KB

Download
memory/2748-3-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2748-6-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/2748-7-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2748-0-0x0000000000220000-0x0000000000310000-memory.dmp

Filesize
960KB

Download
memory/2748-2-0x0000000000540000-0x0000000000648000-memory.dmp

Filesize
1.0MB

Download
memory/2752-14-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-13-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-22-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-23-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-24-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-25-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-26-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-27-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-28-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-29-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download