danabot | d6231724308836e66c5fa21009af32cf671caee48643514f34711551f01f3f96

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe
Size

1.2MB
MD5

b2d6e376b0a35492cf9cf81f89d7dccf
SHA1

41aba57098eb52c142580052be122baf11b3da6a
SHA256

d6231724308836e66c5fa21009af32cf671caee48643514f34711551f01f3f96
SHA512

949708e941775ccd6e49047b78f5d072769ea507bcc1002c79e6d8dbc57bc7525f9396f2a6a66c7f98e4a726d653be2b22e314d965e8eb8871bd7919d19d1494
SSDEEP

24576:m/LwxtQDWsO9jw/ly2pM2DgfbQ0/HFtZDqsd33hL36L:m/ZDAjw/lxmYgzQ0/HFtFl3c

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
44	5100	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
5100	rundll32.exe
5100	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2596	3184	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 5100	3184	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	86
PID 3184 wrote to memory of 5100	3184	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	86
PID 3184 wrote to memory of 5100	3184	b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2d6e376b0a35492cf9cf81f89d7dccf_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\B2D6E3~1.DLL,s C:\Users\Admin\AppData\Local\Temp\B2D6E3~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 508
  2⤵
  - Program crash
  PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3184 -ip 3184
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B2D6E3~1.DLL

Filesize
1.3MB

MD5
4a90c1b66e2c24c2fbe82a17db56ea79

SHA1
a753fd88b1099806e5cf34da6a4077d00355a816

SHA256
5345c92b1180568f1a4842bc495291e2665bd07b9cedc2e7b7cdfaa8258a57ee

SHA512
663e202fbf84f06eda808cd8e69f0201d632b2b801aa556b05cd8540be8d13636c5cc324c1ee195d3ddc9b7aa678bb9a72e183aa68ee1722e558935bf41d2a1a

Download Submit
memory/3184-12-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3184-2-0x0000000000900000-0x0000000000A08000-memory.dmp

Filesize
1.0MB

Download
memory/3184-3-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3184-1-0x00000000007B0000-0x00000000008AE000-memory.dmp

Filesize
1016KB

Download
memory/3184-10-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/3184-11-0x0000000000900000-0x0000000000A08000-memory.dmp

Filesize
1.0MB

Download
memory/5100-13-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download
memory/5100-9-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download
memory/5100-21-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download
memory/5100-22-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download
memory/5100-23-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download
memory/5100-24-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download
memory/5100-25-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download
memory/5100-26-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download
memory/5100-27-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download
memory/5100-28-0x00000000021C0000-0x0000000002323000-memory.dmp

Filesize
1.4MB

Download