danabot | 32b613fc579cc69e56997a4f3c41fd55b98ceb789d324408f450c2b6ad6d03bd

General

Target

4190fb8de9d6a4200750b4d8d54f0720_JaffaCakes118.exe
Size

1.1MB
MD5

4190fb8de9d6a4200750b4d8d54f0720
SHA1

5385fd2aee08a6063dd0527ff8a07d74f8bb61b8
SHA256

32b613fc579cc69e56997a4f3c41fd55b98ceb789d324408f450c2b6ad6d03bd
SHA512

fdaafd89eac9b7f7a540038dbce48cf0e39c4aaa78dfbd6b0b45041386b23f64f827d5e51910fd4b2b7dc4ebde76a5c8ef8a9b9859cb5ca5a1ef4c84b5fdb033
SSDEEP

24576:iv3TbcUVydzoxg50b5SS4SnEynTd+2yda5ZJBWJBrYurUE/I:ivHc5zOgOfVnEsZ1MajusuYD

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b6d-6.dat	DanabotLoader2021
behavioral2/memory/3604-9-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021
behavioral2/memory/3604-13-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021
behavioral2/memory/3604-21-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021
behavioral2/memory/3604-22-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021
behavioral2/memory/3604-23-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021
behavioral2/memory/3604-24-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021
behavioral2/memory/3604-25-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021
behavioral2/memory/3604-26-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021
behavioral2/memory/3604-27-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021
behavioral2/memory/3604-28-0x0000000002440000-0x000000000259E000-memory.dmp	DanabotLoader2021

Blocklisted process makes network request 1 IoCs

flow	pid	Process
37	3604	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
3604	rundll32.exe
3604	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2600	1852	WerFault.exe	83
4984	1852	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4190fb8de9d6a4200750b4d8d54f0720_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3604	1852	4190fb8de9d6a4200750b4d8d54f0720_JaffaCakes118.exe	86
PID 1852 wrote to memory of 3604	1852	4190fb8de9d6a4200750b4d8d54f0720_JaffaCakes118.exe	86
PID 1852 wrote to memory of 3604	1852	4190fb8de9d6a4200750b4d8d54f0720_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\4190fb8de9d6a4200750b4d8d54f0720_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4190fb8de9d6a4200750b4d8d54f0720_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4190FB~1.TMP,S C:\Users\Admin\AppData\Local\Temp\4190FB~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 500
  2⤵
  - Program crash
  PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 524
  2⤵
  - Program crash
  PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1852 -ip 1852
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1852 -ip 1852
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4190FB~1.TMP

Filesize
1.3MB

MD5
00ad9c8b149b8e232e36c5823d73dcb4

SHA1
c8e1a519720ab5acb40766a0f985448e83a5a241

SHA256
23c285510f0c90b0905e5b48efff7bfa34697cca098296e68d16aa391e0d42c7

SHA512
472c1c518221d730a9206b02028fe4f191de4c3cc0003b624ea70795ec2292f8c7522442f8ea4d81a4c0667dc1b7087e463e8abd6d35465ae456d66f4c2d09a4

Download Submit
memory/1852-10-0x0000000000400000-0x0000000002D4C000-memory.dmp

Filesize
41.3MB

Download
memory/1852-2-0x0000000004BD0000-0x0000000004CD0000-memory.dmp

Filesize
1024KB

Download
memory/1852-3-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/1852-1-0x0000000004AB0000-0x0000000004BA3000-memory.dmp

Filesize
972KB

Download
memory/1852-12-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/1852-11-0x0000000004BD0000-0x0000000004CD0000-memory.dmp

Filesize
1024KB

Download
memory/3604-13-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download
memory/3604-9-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download
memory/3604-21-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download
memory/3604-22-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download
memory/3604-23-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download
memory/3604-24-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download
memory/3604-25-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download
memory/3604-26-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download
memory/3604-27-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download
memory/3604-28-0x0000000002440000-0x000000000259E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing