danabot | d076723f1269a1387c69018f4a3fac024b73176f8403372d06a7d58ade52d64e

General

Target

JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe
Size

1.1MB
MD5

8221e011ca9356d2f6f7126eb13553d1
SHA1

73c2e0986be301d0552b8f6662bd786a85cea382
SHA256

d076723f1269a1387c69018f4a3fac024b73176f8403372d06a7d58ade52d64e
SHA512

b87f95122f40708a1b879fa03c8d8f27dd002dae575c684bf06958c4ce93ccf4be04540b51bafab759d61a28cab28f814d12080619ecfac76973a48305a2704a
SSDEEP

24576:tkG2laDqYCofdEED2bde/9MmUkt5SFUwiXhsiNhAf09X:tkcCoV3D25e/9MmUktaaXGxfw

Score

10^/10

danabot 4 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 11 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012280-6.dat	DanabotLoader2021
behavioral1/memory/1652-11-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1652-15-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1652-23-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1652-24-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1652-25-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1652-26-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1652-27-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1652-28-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1652-29-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021
behavioral1/memory/1652-30-0x0000000000770000-0x00000000008D0000-memory.dmp	DanabotLoader2021

Danabot family
danabot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1652	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
1652	rundll32.exe
1652	rundll32.exe
1652	rundll32.exe
1652	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 1652	588	JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe	31
PID 588 wrote to memory of 1652	588	JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe	31
PID 588 wrote to memory of 1652	588	JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe	31
PID 588 wrote to memory of 1652	588	JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe	31
PID 588 wrote to memory of 1652	588	JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe	31
PID 588 wrote to memory of 1652	588	JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe	31
PID 588 wrote to memory of 1652	588	JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8221e011ca9356d2f6f7126eb13553d1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.DLL,s C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.DLL

Filesize
1.3MB

MD5
bf8cc2f8c7c3ed3c369ebdb0d5cfe0b2

SHA1
1f5b01a4494c142790fac09792a72c411acf1499

SHA256
84cc988a7ce6abee459e55796f1e6003a08f13ae94bbcc0723918ca9b8151099

SHA512
f5cb0e075bb5202b921800e288be15067f81e3a84e8f202c419556d2c359573172dbd9ae32c8e12ff33063d4e3a6219ac1ff39cd64daee5b6d89d42010b15a13

Download Submit
memory/588-5-0x0000000000400000-0x0000000002FE6000-memory.dmp

Filesize
43.9MB

Download
memory/588-1-0x0000000004A10000-0x0000000004B15000-memory.dmp

Filesize
1.0MB

Download
memory/588-2-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/588-0-0x0000000004920000-0x0000000004A0E000-memory.dmp

Filesize
952KB

Download
memory/588-14-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/588-13-0x0000000004920000-0x0000000004A0E000-memory.dmp

Filesize
952KB

Download
memory/588-12-0x0000000004A10000-0x0000000004B15000-memory.dmp

Filesize
1.0MB

Download
memory/1652-11-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download
memory/1652-15-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download
memory/1652-23-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download
memory/1652-24-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download
memory/1652-25-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download
memory/1652-26-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download
memory/1652-27-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download
memory/1652-28-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download
memory/1652-29-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download
memory/1652-30-0x0000000000770000-0x00000000008D0000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing