danabot | af756a44f94d5084891d9fc3ee12c3d428e5337370c7ab7f07c7721d27738fd7

General

Target

6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
Size

1.2MB
MD5

6bc8466e6df854ba5b8cee8c1731f145
SHA1

e4a5e419e2f1c05a9531e1af6fac85b53eb8deeb
SHA256

af756a44f94d5084891d9fc3ee12c3d428e5337370c7ab7f07c7721d27738fd7
SHA512

d010f63e3d40b665a75f2860995f3257daede5c7fd1aee42e21d199b69a8af1999c611eb98e6448c7be8fe9047ddc07ce81f68bf8928635cda504ac4ba49f09a
SSDEEP

24576:0nZ+3tXsYjptSPJ1ABLRLEgX3bBRPSMS9ij4JWb+B36L:0nZ05setSR1qtLESR6MOiD+M

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2752 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

2752 rundll32.exe
2752 rundll32.exe
2752 rundll32.exe
2752 rundll32.exe

flow	pid	process
2	2752	rundll32.exe

pid	process
2752	rundll32.exe
2752	rundll32.exe
2752	rundll32.exe
2752	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe

description	pid	process	target process
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe
PID 2748 wrote to memory of 2752	2748	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6BC846~1.DLL,s C:\Users\Admin\AppData\Local\Temp\6BC846~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2752

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\6BC846~1.DLL
Filesize
1.3MB

MD5
c00ae3d536a74e22ddfaad8e2e76cb98

SHA1
a7ee4de67fb30ce482c9b74e2e909f9d495beda2

SHA256
c09a7963607553dc11ff59faf9cfc8d0aa528ce9ab07c8b573ae17ca2a00f059

SHA512
34f37ef1dc9a81cb3ddfe14c66e7a1a6cb8ebdbe25ec15cde8b89927fbcf48ab95ca23c5a31fcba89641b5c455d8c7bce3ca07db823ec77fc9f793ae1e53c2fc

Download Submit
memory/2748-1-0x0000000000220000-0x0000000000310000-memory.dmp

Filesize
960KB

Download
memory/2748-3-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2748-6-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/2748-7-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2748-0-0x0000000000220000-0x0000000000310000-memory.dmp

Filesize
960KB

Download
memory/2748-2-0x0000000000540000-0x0000000000648000-memory.dmp

Filesize
1.0MB

Download
memory/2752-14-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-13-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-22-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-23-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-24-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-25-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-26-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-27-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-28-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download
memory/2752-29-0x0000000002050000-0x00000000021B3000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing