Analysis

  • max time kernel
    141s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 02:32

General

  • Target

    JaffaCakes118_ed3986685132335d9f563db0349f743808626331bdcbd64d915214612840bfcc.exe

  • Size

    1.4MB

  • MD5

    8a0e6424bd0cb2b611055dbcd4dc4d6d

  • SHA1

    61e0f648dec0053d023dbfeaf45cb99086809124

  • SHA256

    ed3986685132335d9f563db0349f743808626331bdcbd64d915214612840bfcc

  • SHA512

    618594997b2e7268a03847a265de44c1246fdc7ab1a7c9a227cf736fcd135ec1949f1f2d53fec6ff04a14bbc9181445e20491dbd9e5f67dae695d2f1bb0e3a68

  • SSDEEP

    24576:Vn1alEjk+odRHc6UDuGZzjtE68lmiGtpfWHg2mWJztt+R+LteieKDRqHquI3uy4:VnY6NUMXZzR7L+AlWJpt+Y/ewyn

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes
  • embedded_hash

    6618C163D57D6441FCCA65D86C4D380D

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot family
  • Blocklisted process makes network request 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed3986685132335d9f563db0349f743808626331bdcbd64d915214612840bfcc.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed3986685132335d9f563db0349f743808626331bdcbd64d915214612840bfcc.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      C:\Windows\system32\agentactivationruntimestarter.exe
      2⤵
        PID:4288
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        • System Location Discovery: System Language Discovery
        PID:2776
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4116
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x408 0x300
      1⤵
        PID:1600

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2776-30-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-31-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-45-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-23-0x0000000000BF0000-0x0000000000BF3000-memory.dmp

        Filesize

        12KB

      • memory/2776-44-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-43-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-42-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-22-0x0000000000BE0000-0x0000000000BE3000-memory.dmp

        Filesize

        12KB

      • memory/2776-39-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-16-0x0000000000B90000-0x0000000000B93000-memory.dmp

        Filesize

        12KB

      • memory/2776-38-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-28-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-27-0x0000000000E30000-0x0000000000E33000-memory.dmp

        Filesize

        12KB

      • memory/2776-21-0x0000000000BD0000-0x0000000000BD3000-memory.dmp

        Filesize

        12KB

      • memory/2776-25-0x0000000000E10000-0x0000000000E13000-memory.dmp

        Filesize

        12KB

      • memory/2776-24-0x0000000000E00000-0x0000000000E03000-memory.dmp

        Filesize

        12KB

      • memory/2776-35-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-29-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/2776-26-0x0000000000E20000-0x0000000000E23000-memory.dmp

        Filesize

        12KB

      • memory/2776-20-0x0000000000BC0000-0x0000000000BC3000-memory.dmp

        Filesize

        12KB

      • memory/2776-19-0x0000000000BB0000-0x0000000000BB3000-memory.dmp

        Filesize

        12KB

      • memory/2776-18-0x0000000000BA0000-0x0000000000BA3000-memory.dmp

        Filesize

        12KB

      • memory/2776-17-0x0000000000E40000-0x0000000000E43000-memory.dmp

        Filesize

        12KB

      • memory/5044-13-0x0000000000400000-0x00000000006E8000-memory.dmp

        Filesize

        2.9MB

      • memory/5044-1-0x0000000002580000-0x00000000026B4000-memory.dmp

        Filesize

        1.2MB

      • memory/5044-2-0x00000000026C0000-0x000000000299B000-memory.dmp

        Filesize

        2.9MB

      • memory/5044-5-0x0000000002580000-0x00000000026B4000-memory.dmp

        Filesize

        1.2MB

      • memory/5044-15-0x0000000000400000-0x00000000006E8000-memory.dmp

        Filesize

        2.9MB

      • memory/5044-14-0x0000000000400000-0x00000000006E8000-memory.dmp

        Filesize

        2.9MB

      • memory/5044-12-0x0000000000400000-0x00000000006E8000-memory.dmp

        Filesize

        2.9MB

      • memory/5044-6-0x00000000026C0000-0x000000000299B000-memory.dmp

        Filesize

        2.9MB

      • memory/5044-4-0x0000000000400000-0x00000000006E8000-memory.dmp

        Filesize

        2.9MB

      • memory/5044-3-0x0000000000400000-0x00000000006E8000-memory.dmp

        Filesize

        2.9MB