danabot | af756a44f94d5084891d9fc3ee12c3d428e5337370c7ab7f07c7721d27738fd7

Analysis

max time kernel
143s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
Size

1.2MB
MD5

6bc8466e6df854ba5b8cee8c1731f145
SHA1

e4a5e419e2f1c05a9531e1af6fac85b53eb8deeb
SHA256

af756a44f94d5084891d9fc3ee12c3d428e5337370c7ab7f07c7721d27738fd7
SHA512

d010f63e3d40b665a75f2860995f3257daede5c7fd1aee42e21d199b69a8af1999c611eb98e6448c7be8fe9047ddc07ce81f68bf8928635cda504ac4ba49f09a
SSDEEP

24576:0nZ+3tXsYjptSPJ1ABLRLEgX3bBRPSMS9ij4JWb+B36L:0nZ05setSR1qtLESR6MOiD+M

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

46 4168 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4168 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5020 2424 WerFault.exe 6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe

flow	pid	process
46	4168	rundll32.exe

pid	process
4168	rundll32.exe

pid	pid_target	process	target process
5020	2424	WerFault.exe	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exe6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe

description	pid	process	target process
PID 2424 wrote to memory of 4168	2424	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe
PID 2424 wrote to memory of 4168	2424	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe
PID 2424 wrote to memory of 4168	2424	6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6BC846~1.DLL,s C:\Users\Admin\AppData\Local\Temp\6BC846~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 500
2⤵
- Program crash
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2424 -ip 2424
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6BC846~1.DLL

Filesize
1.3MB

MD5
1bb59c680a9aff54f44c1695b73e86b0

SHA1
fb4cb0995904cc4d0475b5dfb7dd8edb55fee0a8

SHA256
680b4ba005bcbb0f16bce8de2744741fd8bb4d4e130ff6926e89745ffae7ce56

SHA512
d4e7f4e0bc5106a2eeedde4bf5e6734589d75393b34bb0899127ccd42fcd450fa11f07af322f03ab1a240e58d6761d1376a04682c7e182da87d9dd080f5642ab

Download Submit
memory/2424-1-0x0000000000730000-0x0000000000829000-memory.dmp

Filesize
996KB

Download
memory/2424-2-0x0000000000990000-0x0000000000A98000-memory.dmp

Filesize
1.0MB

Download
memory/2424-3-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2424-8-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/2424-9-0x0000000000990000-0x0000000000A98000-memory.dmp

Filesize
1.0MB

Download
memory/2424-10-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4168-19-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/4168-11-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/4168-20-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/4168-21-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/4168-22-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/4168-23-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/4168-24-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/4168-25-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/4168-26-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download