danabot | d6231724308836e66c5fa21009af32cf671caee48643514f34711551f01f3f96

General

Target

b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe
Size

1.2MB
MD5

b2d6e376b0a35492cf9cf81f89d7dccf
SHA1

41aba57098eb52c142580052be122baf11b3da6a
SHA256

d6231724308836e66c5fa21009af32cf671caee48643514f34711551f01f3f96
SHA512

949708e941775ccd6e49047b78f5d072769ea507bcc1002c79e6d8dbc57bc7525f9396f2a6a66c7f98e4a726d653be2b22e314d965e8eb8871bd7919d19d1494
SSDEEP

24576:m/LwxtQDWsO9jw/ly2pM2DgfbQ0/HFtZDqsd33hL36L:m/ZDAjw/lxmYgzQ0/HFtFl3c

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2128	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2128	2380	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2128	2380	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2128	2380	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2128	2380	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2128	2380	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2128	2380	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2128	2380	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\B2D6E3~1.DLL,s C:\Users\Admin\AppData\Local\Temp\B2D6E3~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B2D6E3~1.DLL

Filesize
1.3MB

MD5
010db8f0031aa76cab6c5665783a1bba

SHA1
a8e866811560cbac9dfc4009797e11653e324637

SHA256
35d61ec55e0a2b3b4f08d0d10d02a515ad1abb7edea8a453200177018bcb8cbb

SHA512
afb712e4b463dd21352bffdfbef3dab7f369f37f6c46802e6089b760c1e6f5bae06a3da8b482418ae1f9fb87c86c67b7ece5de8be3f21d47eec460214252cad9

Download Submit
memory/2128-25-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2128-26-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2128-16-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2128-24-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2128-15-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2128-30-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2128-29-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2128-28-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2128-31-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2128-27-0x0000000002220000-0x0000000002383000-memory.dmp

Filesize
1.4MB

Download
memory/2380-9-0x0000000000740000-0x0000000000848000-memory.dmp

Filesize
1.0MB

Download
memory/2380-0-0x0000000000650000-0x0000000000740000-memory.dmp

Filesize
960KB

Download
memory/2380-7-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2380-3-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2380-1-0x0000000000650000-0x0000000000740000-memory.dmp

Filesize
960KB

Download
memory/2380-6-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2380-2-0x0000000000740000-0x0000000000848000-memory.dmp

Filesize
1.0MB

Download
memory/2380-8-0x0000000000650000-0x0000000000740000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing