danabot | 2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6

General

Target

JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe
Size

1.9MB
MD5

62347da244f5978d9583288fc583f70d
SHA1

7b7f348debfd450f2c0f886bd97ade665b932441
SHA256

2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6
SHA512

db05ac3a3b08ddf25d6d0bc9b28e97d829a6251253c3a430d82d97a12255549bccaf6c1602d4729afc53dbe01cd982ba20216931511740e32d489434adcd0e10
SSDEEP

49152:RUZA7Y3nP7boLvLjHLnUARB+bULaGGqh4BUywgNp8ScpJT:R6tP7wjDLbwB5qh4Fwgb8S0h

Score

10^/10

danabot banker discovery trojan

Malware Config

Extracted

Family

danabot

C2

103.144.139.228:443

213.227.154.98:443

66.85.147.23:443

153.92.223.225:443

Attributes

embedded_hash
A64A3A6ED13022027B84C77D31BE0C74
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Blocklisted process makes network request 10 IoCs

flow	pid	Process
2	936	rundll32.exe
3	936	rundll32.exe
6	936	rundll32.exe
7	936	rundll32.exe
8	936	rundll32.exe
11	936	rundll32.exe
13	936	rundll32.exe
15	936	rundll32.exe
16	936	rundll32.exe
17	936	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
936	rundll32.exe
936	rundll32.exe
936	rundll32.exe
936	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 936	3016	JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe	31
PID 3016 wrote to memory of 936	3016	JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe	31
PID 3016 wrote to memory of 936	3016	JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe	31
PID 3016 wrote to memory of 936	3016	JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe	31
PID 3016 wrote to memory of 936	3016	JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe	31
PID 3016 wrote to memory of 936	3016	JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe	31
PID 3016 wrote to memory of 936	3016	JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e8691f7ff5bad0085f774087ebac60d90d17b2bf50324e9311f1a3d6ed0dcb6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Etfrehti.dll,start C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Etfrehti.dll

Filesize
2.5MB

MD5
d7a66ca4622307cefbaf2d548edf21c1

SHA1
d6e7396cf81fddc86bd9a6adb17dbec09fbd532d

SHA256
c692330b06a1c232eafe7e68f867c6f339ca9545834010b0997e19f936ad0b5d

SHA512
4d9e5fa064ea98af43d5fef363a69a593fdd0ae5f4b79db0794bd5b12e9ffd0c52bb53b7c7b08141f4a33ea7b786f2164504af3295ee9466477270e69b87f41c

Download Submit
memory/936-17-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-29-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-18-0x000000000217B000-0x000000000217F000-memory.dmp

Filesize
16KB

Download
memory/936-30-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-14-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-28-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-15-0x000000000217B000-0x000000000217F000-memory.dmp

Filesize
16KB

Download
memory/936-27-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-26-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-16-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/936-31-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-25-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-21-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-20-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-19-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-23-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/936-24-0x0000000001F30000-0x00000000021C4000-memory.dmp

Filesize
2.6MB

Download
memory/3016-2-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/3016-8-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/3016-9-0x0000000001F30000-0x00000000020D9000-memory.dmp

Filesize
1.7MB

Download
memory/3016-1-0x0000000001F30000-0x00000000020D9000-memory.dmp

Filesize
1.7MB

Download
memory/3016-0-0x0000000001F30000-0x00000000020D9000-memory.dmp

Filesize
1.7MB

Download
memory/3016-6-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/3016-3-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing