danabot | a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe
Size

1.8MB
MD5

8436817e6778e3eb5a74ba02b687ca7d
SHA1

95058ad5387ec6fbde515d9eccc4c1c2ef805d2e
SHA256

a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f
SHA512

e8564dea965998baa44fdbe0e02e6c6f0536e0734039b6b502937774dd0f2a7740e80177339d68add732ce6e34b63583f90e8988c29366c742a75b8a9263ca06
SSDEEP

24576:oJlo/1X4Amh32BP2OBLvWdi3WTyjxLvMG8kcepka/HnvIlOfiOJn4OvB7Yedxvii:o+Xo2R2BAWgZMo/nP6OJnPvndrj3Se0

Score

10^/10

danabot banker discovery trojan

Malware Config

Extracted

Family

danabot

103.144.139.228:443

213.227.154.98:443

66.85.147.23:443

153.92.223.225:443

Attributes

embedded_hash
A64A3A6ED13022027B84C77D31BE0C74
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Blocklisted process makes network request 10 IoCs

flow	pid	Process
14	4920	rundll32.exe
21	4920	rundll32.exe
34	4920	rundll32.exe
35	4920	rundll32.exe
39	4920	rundll32.exe
40	4920	rundll32.exe
47	4920	rundll32.exe
48	4920	rundll32.exe
49	4920	rundll32.exe
50	4920	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4920	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2372	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4920	2372	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	83
PID 2372 wrote to memory of 4920	2372	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	83
PID 2372 wrote to memory of 4920	2372	JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a843b2ee93fc1007fd09df11848e98f4d39057d73a91bcbb99889fb95e3bb86f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Etfrehti.dll,start C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 536
  2⤵
  - Program crash
  PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2372 -ip 2372
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Etfrehti.dll

Filesize
2.5MB

MD5
d7a66ca4622307cefbaf2d548edf21c1

SHA1
d6e7396cf81fddc86bd9a6adb17dbec09fbd532d

SHA256
c692330b06a1c232eafe7e68f867c6f339ca9545834010b0997e19f936ad0b5d

SHA512
4d9e5fa064ea98af43d5fef363a69a593fdd0ae5f4b79db0794bd5b12e9ffd0c52bb53b7c7b08141f4a33ea7b786f2164504af3295ee9466477270e69b87f41c

Download Submit
memory/2372-8-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2372-2-0x0000000002550000-0x000000000272C000-memory.dmp

Filesize
1.9MB

Download
memory/2372-3-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2372-1-0x0000000002370000-0x000000000251F000-memory.dmp

Filesize
1.7MB

Download
memory/2372-9-0x0000000002550000-0x000000000272C000-memory.dmp

Filesize
1.9MB

Download
memory/4920-14-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-18-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-12-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-13-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-7-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-15-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-16-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-10-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/4920-19-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-21-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-22-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-23-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-24-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/4920-25-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download