danabot | a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f

General

Target

JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe
Size

1.8MB
MD5

8436817e6778e3eb5a74ba02b687ca7d
SHA1

95058ad5387ec6fbde515d9eccc4c1c2ef805d2e
SHA256

a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f
SHA512

e8564dea965998baa44fdbe0e02e6c6f0536e0734039b6b502937774dd0f2a7740e80177339d68add732ce6e34b63583f90e8988c29366c742a75b8a9263ca06
SSDEEP

24576:oJlo/1X4Amh32BP2OBLvWdi3WTyjxLvMG8kcepka/HnvIlOfiOJn4OvB7Yedxvii:o+Xo2R2BAWgZMo/nP6OJnPvndrj3Se0

Score

10^/10

danabot banker discovery trojan

Malware Config

Extracted

Family

danabot

C2

103.144.139.228:443

213.227.154.98:443

66.85.147.23:443

153.92.223.225:443

Attributes

embedded_hash
A64A3A6ED13022027B84C77D31BE0C74
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Loads dropped DLL 4 IoCs

pid	Process
2720	rundll32.exe
2720	rundll32.exe
2720	rundll32.exe
2720	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2720	2412	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	31
PID 2412 wrote to memory of 2720	2412	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	31
PID 2412 wrote to memory of 2720	2412	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	31
PID 2412 wrote to memory of 2720	2412	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	31
PID 2412 wrote to memory of 2720	2412	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	31
PID 2412 wrote to memory of 2720	2412	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	31
PID 2412 wrote to memory of 2720	2412	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Etfrehti.dll,start C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Etfrehti.dll

Filesize
2.5MB

MD5
d7a66ca4622307cefbaf2d548edf21c1

SHA1
d6e7396cf81fddc86bd9a6adb17dbec09fbd532d

SHA256
c692330b06a1c232eafe7e68f867c6f339ca9545834010b0997e19f936ad0b5d

SHA512
4d9e5fa064ea98af43d5fef363a69a593fdd0ae5f4b79db0794bd5b12e9ffd0c52bb53b7c7b08141f4a33ea7b786f2164504af3295ee9466477270e69b87f41c

Download Submit
memory/2412-0-0x0000000001F30000-0x00000000020D9000-memory.dmp

Filesize
1.7MB

Download
memory/2412-1-0x0000000001F30000-0x00000000020D9000-memory.dmp

Filesize
1.7MB

Download
memory/2412-2-0x00000000020E0000-0x00000000022BC000-memory.dmp

Filesize
1.9MB

Download
memory/2412-3-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2412-8-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2412-7-0x0000000001F30000-0x00000000020D9000-memory.dmp

Filesize
1.7MB

Download
memory/2412-6-0x00000000020E0000-0x00000000022BC000-memory.dmp

Filesize
1.9MB

Download
memory/2720-16-0x0000000002A70000-0x0000000002A71000-memory.dmp

Filesize
4KB

Download
memory/2720-21-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-15-0x000000000226B000-0x000000000226F000-memory.dmp

Filesize
16KB

Download
memory/2720-18-0x000000000226B000-0x000000000226F000-memory.dmp

Filesize
16KB

Download
memory/2720-17-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-19-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-20-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-14-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-23-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-24-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-26-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-27-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-29-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-30-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download
memory/2720-31-0x0000000002020000-0x00000000022B4000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing