danabot | f2d61c2a543ace968656c8b5ce34b198d511f827b33412c188c7103552cdae0b

General

Target

JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe
Size

1.2MB
MD5

8ce6593b18a252b82fab20961dffc1ed
SHA1

998ae028d91d1381f425ef40bb25fb549f2a4fb5
SHA256

f2d61c2a543ace968656c8b5ce34b198d511f827b33412c188c7103552cdae0b
SHA512

3d1cccadfde86a219e7ecb1059d5e204660eb936fff90afd474d2ecf2573479a0dd884783805bdd4ed4ddb712ccff5aa3a2dc02c3afc8af0411c122bd069ae6d
SSDEEP

24576:clEuyGJyuBtI2q7O2S2pFLRCvKtzbigmT14QWxy+9w:tGJyf9S2LROKsP

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1824	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
1824	rundll32.exe
1824	rundll32.exe
1824	rundll32.exe
1824	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1824	2192	JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe	30
PID 2192 wrote to memory of 1824	2192	JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe	30
PID 2192 wrote to memory of 1824	2192	JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe	30
PID 2192 wrote to memory of 1824	2192	JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe	30
PID 2192 wrote to memory of 1824	2192	JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe	30
PID 2192 wrote to memory of 1824	2192	JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe	30
PID 2192 wrote to memory of 1824	2192	JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ce6593b18a252b82fab20961dffc1ed.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.DLL,s C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.DLL

Filesize
1.3MB

MD5
a12c63c4b0e5d61545ef2c4212720005

SHA1
5169772503fe0d962b3c5826a881302bc2a7cfca

SHA256
7379c68e167825bded4e5bb69f517ce89bdddff8d5b561f59f9f1789d1cfe23b

SHA512
74cd5ae896cb9e77fe27633c405d0a3e4b167f1def4bdd30663b05c13a5617073840727ad4f23318d9753d13a3d00ea544caff2326718df5019c71b0902145f5

Download Submit
memory/1824-25-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/1824-26-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/1824-16-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/1824-24-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/1824-15-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/1824-30-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/1824-29-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/1824-28-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/1824-31-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/1824-27-0x0000000001ED0000-0x0000000002034000-memory.dmp

Filesize
1.4MB

Download
memory/2192-9-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2192-0-0x0000000000870000-0x0000000000960000-memory.dmp

Filesize
960KB

Download
memory/2192-7-0x00000000021F0000-0x00000000022F6000-memory.dmp

Filesize
1.0MB

Download
memory/2192-3-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2192-1-0x0000000000870000-0x0000000000960000-memory.dmp

Filesize
960KB

Download
memory/2192-6-0x0000000000400000-0x0000000000865000-memory.dmp

Filesize
4.4MB

Download
memory/2192-2-0x00000000021F0000-0x00000000022F6000-memory.dmp

Filesize
1.0MB

Download
memory/2192-8-0x0000000000870000-0x0000000000960000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing