danabot | c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153

General

Target

JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe
Size

2.4MB
MD5

a99ba5e3ee29ef81901007d0be9a7f13
SHA1

aba8d1a54492d9d186ecbcb9db17305fd7e05190
SHA256

c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153
SHA512

74cf44660c45bf6b524ee28582c30fcbd85c765d6c9de4b61438bb824f75a24f28faeb233e5a0461e925e091d05a68133b150597471208dc1a8fef91bd50ac54
SSDEEP

49152:P8FuJcSxvss7pLkUubih/3PeYkVVfRzZ8ikfO2f:EFuJFRsKRkU5VWjVfRKP

Score

10^/10

danabot banker discovery trojan

Malware Config

Extracted

Family

danabot

C2

153.92.223.225:443

198.15.112.179:443

185.62.56.245:443

66.85.147.23:443

Attributes

embedded_hash
61A1CB063216C13FFD2E15D7F3F515E2
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Blocklisted process makes network request 10 IoCs

flow	pid	Process
2	2776	rundll32.exe
3	2776	rundll32.exe
4	2776	rundll32.exe
5	2776	rundll32.exe
6	2776	rundll32.exe
7	2776	rundll32.exe
9	2776	rundll32.exe
11	2776	rundll32.exe
12	2776	rundll32.exe
13	2776	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
2776	rundll32.exe
2776	rundll32.exe
2776	rundll32.exe
2776	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2776	2700	JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe	30
PID 2700 wrote to memory of 2776	2700	JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe	30
PID 2700 wrote to memory of 2776	2700	JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe	30
PID 2700 wrote to memory of 2776	2700	JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe	30
PID 2700 wrote to memory of 2776	2700	JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe	30
PID 2700 wrote to memory of 2776	2700	JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe	30
PID 2700 wrote to memory of 2776	2700	JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5119795d525e2dad1428be6f5cd89a933dbc22d50da97ee37c4728dfcf4d153.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Pedeuesu.dll,start C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Pedeuesu.dll

Filesize
3.4MB

MD5
0a4be075ff7c43377937669f2e6c040a

SHA1
d097e78537fa7876757256583a47024bf0006fd6

SHA256
351342c60677616c25d8869362ba951102519c9df9761d049a55409fe51387bf

SHA512
cd9b365a889d36ab480ca1ab4f09351b84cff3f0ec26d6b0da5c82507435d9b9b84d835e17b1d41ac73815513dfa7082615719cf388c05f8f4abdf7d8e449e2c

Download Submit
memory/2700-0-0x0000000002260000-0x00000000024A0000-memory.dmp

Filesize
2.2MB

Download
memory/2700-1-0x0000000002260000-0x00000000024A0000-memory.dmp

Filesize
2.2MB

Download
memory/2700-2-0x00000000024A0000-0x0000000002713000-memory.dmp

Filesize
2.4MB

Download
memory/2700-3-0x0000000000400000-0x000000000067F000-memory.dmp

Filesize
2.5MB

Download
memory/2700-9-0x0000000000400000-0x000000000067F000-memory.dmp

Filesize
2.5MB

Download
memory/2700-7-0x0000000002260000-0x00000000024A0000-memory.dmp

Filesize
2.2MB

Download
memory/2700-6-0x00000000024A0000-0x0000000002713000-memory.dmp

Filesize
2.4MB

Download
memory/2700-5-0x0000000000400000-0x00000000007CA000-memory.dmp

Filesize
3.8MB

Download
memory/2776-15-0x0000000002745000-0x0000000002749000-memory.dmp

Filesize
16KB

Download
memory/2776-22-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-16-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-17-0x0000000002745000-0x0000000002749000-memory.dmp

Filesize
16KB

Download
memory/2776-18-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-20-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-21-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-14-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-24-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-25-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-26-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-27-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-29-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download
memory/2776-30-0x0000000002430000-0x00000000027AF000-memory.dmp

Filesize
3.5MB

Download

Analysis

Sharing