danabot | fe7ce2b5ac19e2fc93436e1eddab8bc79043c518078559b8f9a2984a601b36cd

General

Target

914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe
Size

1.1MB
MD5

914572ae32ea3b7fda9860a619373534
SHA1

afcd7d7280d9a19e69c056f8699283b4b92e435d
SHA256

fe7ce2b5ac19e2fc93436e1eddab8bc79043c518078559b8f9a2984a601b36cd
SHA512

b732d245509d13d98b23fd0b21878a03a0451db10f22334c2f8fd16f930ed961ae6ae1947a327001d3b4b76cf092a5fb9702df1f596452c9d3affd594d5577d7
SSDEEP

24576:Fmi/0mAnPFpGJD02Ev/J9IMYRys50FCs5p1ISI:96PFpKDKXJeks50FCstIl

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000120f6-7.dat	DanabotLoader2021
behavioral1/memory/2136-12-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2136-13-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2136-21-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2136-22-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2136-23-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2136-24-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2136-25-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2136-26-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2136-27-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021
behavioral1/memory/2136-28-0x0000000000AF0000-0x0000000000C4E000-memory.dmp	DanabotLoader2021

Danabot family
danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2136	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2136	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2136	2080	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2136	2080	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2136	2080	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2136	2080	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2136	2080	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2136	2080	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2136	2080	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\914572~1.TMP,S C:\Users\Admin\AppData\Local\Temp\914572~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\914572~1.TMP

Filesize
1.3MB

MD5
00ad9c8b149b8e232e36c5823d73dcb4

SHA1
c8e1a519720ab5acb40766a0f985448e83a5a241

SHA256
23c285510f0c90b0905e5b48efff7bfa34697cca098296e68d16aa391e0d42c7

SHA512
472c1c518221d730a9206b02028fe4f191de4c3cc0003b624ea70795ec2292f8c7522442f8ea4d81a4c0667dc1b7087e463e8abd6d35465ae456d66f4c2d09a4

Download Submit
memory/2080-6-0x0000000000400000-0x0000000002D4E000-memory.dmp

Filesize
41.3MB

Download
memory/2080-1-0x0000000002D50000-0x0000000002E3A000-memory.dmp

Filesize
936KB

Download
memory/2080-2-0x0000000002F90000-0x0000000003090000-memory.dmp

Filesize
1024KB

Download
memory/2080-3-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/2080-9-0x0000000002D50000-0x0000000002E3A000-memory.dmp

Filesize
936KB

Download
memory/2080-10-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/2080-8-0x0000000002F90000-0x0000000003090000-memory.dmp

Filesize
1024KB

Download
memory/2080-0-0x0000000002D50000-0x0000000002E3A000-memory.dmp

Filesize
936KB

Download
memory/2136-12-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download
memory/2136-13-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download
memory/2136-21-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download
memory/2136-22-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download
memory/2136-23-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download
memory/2136-24-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download
memory/2136-25-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download
memory/2136-26-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download
memory/2136-27-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download
memory/2136-28-0x0000000000AF0000-0x0000000000C4E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing