danabot | 62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0

General

Target

JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe
Size

2.4MB
MD5

9eeb9cb8686a5c889b129f1b0102d8f3
SHA1

0dafd3c3221b52a501c128db6a6b1caa38cb40d6
SHA256

62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0
SHA512

283056675c91a7aeaf31f06a42cb8e4eb15af641015de38e250b13ec2f44ccb0ac5039c71301eaee15fdd0327eeddc48975c9b3fe0c03f5101ef28dc08143b01
SSDEEP

49152:+APZpKQMr3TZdWScpyS8w1F3RIh3xUuf3Qyx8Ya6NGAhyG0qoZn6i:+A4RdWLyJw7Off3Qyx8j6NGhGyZn6

Score

10^/10

danabot banker discovery trojan

Malware Config

Extracted

Family

danabot

C2

153.92.223.225:443

198.15.112.179:443

185.62.56.245:443

66.85.147.23:443

Attributes

embedded_hash
61A1CB063216C13FFD2E15D7F3F515E2
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Blocklisted process makes network request 9 IoCs

flow	pid	Process
2	1920	rundll32.exe
3	1920	rundll32.exe
4	1920	rundll32.exe
5	1920	rundll32.exe
6	1920	rundll32.exe
7	1920	rundll32.exe
8	1920	rundll32.exe
10	1920	rundll32.exe
12	1920	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
1920	rundll32.exe
1920	rundll32.exe
1920	rundll32.exe
1920	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1920	2092	JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe	31
PID 2092 wrote to memory of 1920	2092	JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe	31
PID 2092 wrote to memory of 1920	2092	JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe	31
PID 2092 wrote to memory of 1920	2092	JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe	31
PID 2092 wrote to memory of 1920	2092	JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe	31
PID 2092 wrote to memory of 1920	2092	JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe	31
PID 2092 wrote to memory of 1920	2092	JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62727e3c7568b4cc97feda013a1bc851fe2682f5bca8a98ee4db0fd025fb76d0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Pedeuesu.dll,start C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Pedeuesu.dll

Filesize
3.4MB

MD5
0a4be075ff7c43377937669f2e6c040a

SHA1
d097e78537fa7876757256583a47024bf0006fd6

SHA256
351342c60677616c25d8869362ba951102519c9df9761d049a55409fe51387bf

SHA512
cd9b365a889d36ab480ca1ab4f09351b84cff3f0ec26d6b0da5c82507435d9b9b84d835e17b1d41ac73815513dfa7082615719cf388c05f8f4abdf7d8e449e2c

Download Submit
memory/1920-20-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-25-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-16-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-17-0x0000000002305000-0x0000000002309000-memory.dmp

Filesize
16KB

Download
memory/1920-29-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-28-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-26-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-22-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-18-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-15-0x0000000002305000-0x0000000002309000-memory.dmp

Filesize
16KB

Download
memory/1920-30-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-23-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-14-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/1920-19-0x0000000001FF0000-0x000000000236F000-memory.dmp

Filesize
3.5MB

Download
memory/2092-1-0x0000000002030000-0x0000000002270000-memory.dmp

Filesize
2.2MB

Download
memory/2092-0-0x0000000002030000-0x0000000002270000-memory.dmp

Filesize
2.2MB

Download
memory/2092-3-0x0000000000400000-0x000000000067F000-memory.dmp

Filesize
2.5MB

Download
memory/2092-7-0x0000000002030000-0x0000000002270000-memory.dmp

Filesize
2.2MB

Download
memory/2092-2-0x0000000002270000-0x00000000024E3000-memory.dmp

Filesize
2.4MB

Download
memory/2092-9-0x0000000000400000-0x000000000067F000-memory.dmp

Filesize
2.5MB

Download
memory/2092-5-0x0000000000400000-0x00000000007CA000-memory.dmp

Filesize
3.8MB

Download
memory/2092-6-0x0000000002270000-0x00000000024E3000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing