Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-08-2024 23:57

General

  • Target

    a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe

  • Size

    4.0MB

  • MD5

    a8c0796d74fe9e34fe0c67a500dc7b32

  • SHA1

    ebdd34cd4fda39ade14e4fc0c4e8ce4b397e8959

  • SHA256

    0ff222e570a6934c471b2bcb13b78f88c75e95141b7c84bbd3dc936d7d46437b

  • SHA512

    906db571ec138e9fec43e9182ecf2a6a2af7120f85169e14e68d4632c36bf785768a87e2043c9107b0db23f0a3f7c7473b8b1a45a943b79d68d9baf2d8bede33

  • SSDEEP

    98304:acC8excbiUsPc9K7YrHDjJzp1PGcjXF1D4TQ4Ll5nZGv13dwsBD:acC8eKGU8c9fVpBLJ1MT5J5nZp

Malware Config

Extracted

Family

danabot

Version

1765

Botnet

3

C2

79.124.78.236:443

134.119.186.199:443

192.236.162.42:443

134.119.186.198:443

Attributes
  • embedded_hash

    82C66843DE542BC5CB88F713DE39B52B

  • type

    main

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\A8C079~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\A8C079~1.EXE
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\SysWOW64\RUNDLL32.EXE
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\A8C079~1.DLL,aR9KfI0=
        3⤵
        • Blocklisted process makes network request
        • Checks computer location settings
        • Loads dropped DLL
        • Accesses Microsoft Outlook accounts
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:2076
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp9EFF.tmp.ps1"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2324
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpAB84.tmp.ps1"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:60
          • C:\Windows\SysWOW64\nslookup.exe
            "C:\Windows\system32\nslookup.exe" -type=any localhost
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2264
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2248
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4788
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 524
      2⤵
      • Program crash
      PID:3628
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5028 -ip 5028
    1⤵
      PID:4060

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001

      Filesize

      41B

      MD5

      5af87dfd673ba2115e2fcf5cfdb727ab

      SHA1

      d5b5bbf396dc291274584ef71f444f420b6056f1

      SHA256

      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

      SHA512

      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      6ad58b45ba900fe2b784c35fe1ddd496

      SHA1

      7701cf4dfebc92b77e3d16a4094dac0def34f13a

      SHA256

      139a32ad96800367dc709be507e2b78e667610000be7c68f94c174e6fa60f84f

      SHA512

      168f58da543d5c3a645c9a51916528c8e291f0f49069fb8567328e6960874a97026839a31a3505bcd1cc26320a477fbd095406ff3e12c4419c5429b729cd9c1a

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      17KB

      MD5

      88649f8b7e5b60e6c73c7654e992f8bc

      SHA1

      e733e1a13915ba0e26d8d0d9612fc0a429e1c9f9

      SHA256

      8284694160e5c9d583311a4236e1e00ea6f56b17985d0488c78a76b8b9ee11a8

      SHA512

      001e54a62c52ebb308f6a8125d18199fe33818586c1eeb615fedcb759d3ae8c2b796ca4dacaa3c48581bdee857071180fb25642b116abbfa0c67e86552033aed

    • C:\Users\Admin\AppData\Local\Temp\A8C079~1.DLL

      Filesize

      3.8MB

      MD5

      0fa776ebc6c175716ddae5d5ce2a5894

      SHA1

      3dbb9ac31089481cdba10345889f73d9acb59a02

      SHA256

      fda53157a533ba28a067f49b29c517b1e7ac91cba890aa5bcb2ed245a036cdd7

      SHA512

      55d11b53fe9134bf8b43a017591a27bedb9d539c5bac03e93cd3cd4a8a96b3f7030b9ad9fec373a0cf6e88a0776f32a3c57388dcb6114e895733fd45a5922b9e

    • C:\Users\Admin\AppData\Local\Temp\KZYBFHMK-20240802-1241.log

      Filesize

      57KB

      MD5

      35d980fc217a8339451936395a7898e5

      SHA1

      3754d39933a0d05d17da673d35e7220f0950649e

      SHA256

      a0c3f52d2dc241ffefa0f0555cb634e15b08520c919665b822c15cf44b1c774d

      SHA512

      85e122b5652223aadbd84d850afa2cac4e78868e713628d39add945f7d0f76a8c0686c53c37d8d5dc0c5bdd89ee064ff7965d8d5cfbb76d2d95ce7fe767007b0

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tlgabm3a.lws.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\lpxujfdmgmkbl.tmp

      Filesize

      2KB

      MD5

      4e81ac5d6924a73248882b52cef0bfe1

      SHA1

      8ec4883d08cd6e0c602866e3c119e03ff2331d61

      SHA256

      d7b3a8608ba4ac05cb0c1673448f9fe89e5ff45cc58a893c1d272393a891d6b1

      SHA512

      df87a0177e2f31dea063f6508abd19352e550a023a252d94072481f3483c9767ba9950c28582024ed83ca78f4b9f43be01889e30cdc7626e353be0e9f20bcf89

    • C:\Users\Admin\AppData\Local\Temp\tmp9EFF.tmp.ps1

      Filesize

      261B

      MD5

      de321f2e5f97a90272fddcacbf576778

      SHA1

      99ee5c83d661b091cc0cfc29dc5ddfb79c11d7f0

      SHA256

      4f1d0820575841d9fb489e4a4618e55096023ebcda3c19f40f6b5ebc52e78d92

      SHA512

      1e01ef9e335e26a32b3361184357aeb5bccb49c29891508967767ccd0e6107c260465e487cfeea4cf89b1abbc6f8cbe1ff8fa7094a681b4d55ecf90febdaeaf9

    • C:\Users\Admin\AppData\Local\Temp\tmp9F00.tmp

      Filesize

      1KB

      MD5

      c416c12d1b2b1da8c8655e393b544362

      SHA1

      fb1a43cd8e1c556c2d25f361f42a21293c29e447

      SHA256

      0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046

      SHA512

      cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c

    • C:\Users\Admin\AppData\Local\Temp\tmpAB84.tmp.ps1

      Filesize

      80B

      MD5

      299c6974d15d21c234c1c20d70856559

      SHA1

      68fc491d16f90d473da877510e4bcf2c9183548d

      SHA256

      7c554dd49154dab22487f79d6537d6a0ad2225ba48bbdf36b60179b76b829be2

      SHA512

      aeffb998763cc6a32d2306018c95cf298c6f61c1f4a445dd1222e06d452fbe96c1410458f930909120e1fc05cf779ea9ddbbf6ca3ee6fdf5a20dc5574122516d

    • C:\Users\Admin\AppData\Local\Temp\tmpAB85.tmp

      Filesize

      86B

      MD5

      1860260b2697808b80802352fe324782

      SHA1

      f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

      SHA256

      0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

      SHA512

      d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

    • memory/60-72-0x00000000061C0000-0x0000000006514000-memory.dmp

      Filesize

      3.3MB

    • memory/60-83-0x0000000006D70000-0x0000000006DBC000-memory.dmp

      Filesize

      304KB

    • memory/1064-11-0x0000000003500000-0x0000000003501000-memory.dmp

      Filesize

      4KB

    • memory/1064-13-0x0000000002C80000-0x00000000032E2000-memory.dmp

      Filesize

      6.4MB

    • memory/1064-8-0x0000000002330000-0x00000000026FD000-memory.dmp

      Filesize

      3.8MB

    • memory/1064-9-0x0000000002C80000-0x00000000032E2000-memory.dmp

      Filesize

      6.4MB

    • memory/1064-10-0x0000000002C80000-0x00000000032E2000-memory.dmp

      Filesize

      6.4MB

    • memory/2076-93-0x0000000002DF0000-0x0000000003452000-memory.dmp

      Filesize

      6.4MB

    • memory/2076-90-0x0000000000400000-0x00000000007CD000-memory.dmp

      Filesize

      3.8MB

    • memory/2076-19-0x0000000002DF0000-0x0000000003452000-memory.dmp

      Filesize

      6.4MB

    • memory/2076-95-0x0000000002DF0000-0x0000000003452000-memory.dmp

      Filesize

      6.4MB

    • memory/2076-14-0x0000000002DF0000-0x0000000003452000-memory.dmp

      Filesize

      6.4MB

    • memory/2076-15-0x00000000007D0000-0x00000000007D1000-memory.dmp

      Filesize

      4KB

    • memory/2076-92-0x0000000002DF0000-0x0000000003452000-memory.dmp

      Filesize

      6.4MB

    • memory/2076-20-0x0000000002DF0000-0x0000000003452000-memory.dmp

      Filesize

      6.4MB

    • memory/2076-22-0x0000000002DF0000-0x0000000003452000-memory.dmp

      Filesize

      6.4MB

    • memory/2076-21-0x0000000002DF0000-0x0000000003452000-memory.dmp

      Filesize

      6.4MB

    • memory/2324-44-0x00000000062F0000-0x0000000006356000-memory.dmp

      Filesize

      408KB

    • memory/2324-40-0x0000000005320000-0x0000000005356000-memory.dmp

      Filesize

      216KB

    • memory/2324-60-0x0000000006E30000-0x0000000006E4A000-memory.dmp

      Filesize

      104KB

    • memory/2324-61-0x0000000007A80000-0x0000000007A88000-memory.dmp

      Filesize

      32KB

    • memory/2324-58-0x0000000006BF0000-0x0000000006BFA000-memory.dmp

      Filesize

      40KB

    • memory/2324-56-0x00000000068F0000-0x000000000693C000-memory.dmp

      Filesize

      304KB

    • memory/2324-55-0x00000000068B0000-0x00000000068CE000-memory.dmp

      Filesize

      120KB

    • memory/2324-54-0x0000000006460000-0x00000000067B4000-memory.dmp

      Filesize

      3.3MB

    • memory/2324-43-0x0000000006210000-0x0000000006276000-memory.dmp

      Filesize

      408KB

    • memory/2324-59-0x0000000007F00000-0x000000000857A000-memory.dmp

      Filesize

      6.5MB

    • memory/2324-42-0x0000000005920000-0x0000000005942000-memory.dmp

      Filesize

      136KB

    • memory/2324-41-0x0000000005A30000-0x0000000006058000-memory.dmp

      Filesize

      6.2MB

    • memory/5028-1-0x0000000000F40000-0x000000000130F000-memory.dmp

      Filesize

      3.8MB

    • memory/5028-16-0x0000000000400000-0x0000000000C49000-memory.dmp

      Filesize

      8.3MB

    • memory/5028-18-0x0000000000400000-0x00000000007EA000-memory.dmp

      Filesize

      3.9MB

    • memory/5028-17-0x0000000001310000-0x00000000016EF000-memory.dmp

      Filesize

      3.9MB

    • memory/5028-3-0x0000000000400000-0x00000000007EA000-memory.dmp

      Filesize

      3.9MB

    • memory/5028-2-0x0000000001310000-0x00000000016EF000-memory.dmp

      Filesize

      3.9MB