danabot | fe7ce2b5ac19e2fc93436e1eddab8bc79043c518078559b8f9a2984a601b36cd

General

Target

914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe
Size

1.1MB
MD5

914572ae32ea3b7fda9860a619373534
SHA1

afcd7d7280d9a19e69c056f8699283b4b92e435d
SHA256

fe7ce2b5ac19e2fc93436e1eddab8bc79043c518078559b8f9a2984a601b36cd
SHA512

b732d245509d13d98b23fd0b21878a03a0451db10f22334c2f8fd16f930ed961ae6ae1947a327001d3b4b76cf092a5fb9702df1f596452c9d3affd594d5577d7
SSDEEP

24576:Fmi/0mAnPFpGJD02Ev/J9IMYRys50FCs5p1ISI:96PFpKDKXJeks50FCstIl

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b43-7.dat	DanabotLoader2021
behavioral2/memory/548-9-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021
behavioral2/memory/548-13-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021
behavioral2/memory/548-21-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021
behavioral2/memory/548-22-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021
behavioral2/memory/548-23-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021
behavioral2/memory/548-24-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021
behavioral2/memory/548-25-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021
behavioral2/memory/548-26-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021
behavioral2/memory/548-27-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021
behavioral2/memory/548-28-0x0000000002350000-0x00000000024AE000-memory.dmp	DanabotLoader2021

Danabot family
danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
37	548	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
548	rundll32.exe
548	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	1396	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 548	1396	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	82
PID 1396 wrote to memory of 548	1396	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	82
PID 1396 wrote to memory of 548	1396	914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\914572ae32ea3b7fda9860a619373534_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\914572~1.TMP,S C:\Users\Admin\AppData\Local\Temp\914572~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 536
  2⤵
  - Program crash
  PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1396 -ip 1396
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\914572~1.EXE.tmp

Filesize
1.3MB

MD5
00ad9c8b149b8e232e36c5823d73dcb4

SHA1
c8e1a519720ab5acb40766a0f985448e83a5a241

SHA256
23c285510f0c90b0905e5b48efff7bfa34697cca098296e68d16aa391e0d42c7

SHA512
472c1c518221d730a9206b02028fe4f191de4c3cc0003b624ea70795ec2292f8c7522442f8ea4d81a4c0667dc1b7087e463e8abd6d35465ae456d66f4c2d09a4

Download Submit
memory/548-13-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/548-23-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/548-28-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/548-9-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/548-21-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/548-27-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/548-26-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/548-25-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/548-24-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/548-22-0x0000000002350000-0x00000000024AE000-memory.dmp

Filesize
1.4MB

Download
memory/1396-1-0x0000000004990000-0x0000000004A84000-memory.dmp

Filesize
976KB

Download
memory/1396-12-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/1396-10-0x0000000000400000-0x0000000002D4E000-memory.dmp

Filesize
41.3MB

Download
memory/1396-3-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/1396-11-0x0000000004A90000-0x0000000004B90000-memory.dmp

Filesize
1024KB

Download
memory/1396-2-0x0000000004A90000-0x0000000004B90000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing