danabot | ebce9843b6f8483818e08e94b5c2ddee05f9ee325a7b7b4fb1bb66a797e97b1c

Resubmissions

05-01-2025 11:57

250105-n4sklstkgv 10

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a2602db74991cc82d39a84ca9459a988.exe
Size

1.2MB
MD5

a2602db74991cc82d39a84ca9459a988
SHA1

6465170dde69a1019768f91ca66c2eb70db11e0e
SHA256

ebce9843b6f8483818e08e94b5c2ddee05f9ee325a7b7b4fb1bb66a797e97b1c
SHA512

a63aead9f430577090255ef3f0bdd03781675bf4c2783a53154f4338e0595c0a67dd96bcd675a46c282444e5662cbd531e0d710beb7487ecc8273a9e56f5f428
SSDEEP

24576:aDPPGsLmRUSTuUqbMknnTK/drRsJfeTI+IpbNm7BPAyEHE3wvK9n+nnkDK:OPuUpnTK/drRwfblbNmuyqK

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 10 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c98-6.dat	DanabotLoader2021
behavioral2/memory/3612-11-0x0000000000400000-0x0000000000563000-memory.dmp	DanabotLoader2021
behavioral2/memory/3612-19-0x0000000000400000-0x0000000000563000-memory.dmp	DanabotLoader2021
behavioral2/memory/3612-20-0x0000000000400000-0x0000000000563000-memory.dmp	DanabotLoader2021
behavioral2/memory/3612-21-0x0000000000400000-0x0000000000563000-memory.dmp	DanabotLoader2021
behavioral2/memory/3612-22-0x0000000000400000-0x0000000000563000-memory.dmp	DanabotLoader2021
behavioral2/memory/3612-23-0x0000000000400000-0x0000000000563000-memory.dmp	DanabotLoader2021
behavioral2/memory/3612-24-0x0000000000400000-0x0000000000563000-memory.dmp	DanabotLoader2021
behavioral2/memory/3612-25-0x0000000000400000-0x0000000000563000-memory.dmp	DanabotLoader2021
behavioral2/memory/3612-26-0x0000000000400000-0x0000000000563000-memory.dmp	DanabotLoader2021

Danabot family
danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
36	3612	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
3612	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4920	2172	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a2602db74991cc82d39a84ca9459a988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3612	2172	JaffaCakes118_a2602db74991cc82d39a84ca9459a988.exe	82
PID 2172 wrote to memory of 3612	2172	JaffaCakes118_a2602db74991cc82d39a84ca9459a988.exe	82
PID 2172 wrote to memory of 3612	2172	JaffaCakes118_a2602db74991cc82d39a84ca9459a988.exe	82

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2602db74991cc82d39a84ca9459a988.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2602db74991cc82d39a84ca9459a988.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.DLL,s C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 540
  2⤵
  - Program crash
  PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2172 -ip 2172
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.DLL

Filesize
1.3MB

MD5
e505ea4495ebe1e5bf5a00fc519d47ca

SHA1
9c7f84a7e56f20ea415d38e83f2a22464b51c56f

SHA256
584f3e54013eea8e13ef1b3f3c03c6b64881fe45eac0a64f72693a74bff2d398

SHA512
a1e5fbbf19bac401b6210b47fb0b015b2e28a63195011811a2fcdfd807242e177a036e2dced85f2f0a7bc885c1d1d74c95b00f67cba25dcf5f25a2c368567bec

Download Submit
memory/2172-1-0x0000000002670000-0x0000000002769000-memory.dmp

Filesize
996KB

Download
memory/2172-2-0x00000000027E0000-0x00000000028E7000-memory.dmp

Filesize
1.0MB

Download
memory/2172-3-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2172-10-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2172-9-0x00000000027E0000-0x00000000028E7000-memory.dmp

Filesize
1.0MB

Download
memory/2172-8-0x0000000000400000-0x0000000000865000-memory.dmp

Filesize
4.4MB

Download
memory/3612-19-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/3612-11-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/3612-20-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/3612-21-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/3612-22-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/3612-23-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/3612-24-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/3612-25-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/3612-26-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download