danabot | 0a38204354bdd03ca06520f5482cc057a926eef96944a2a179c370b9f64f4842

Analysis

max time kernel
142s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 00:53

Target

7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe
Size

847KB
MD5

7efdce6925f9d0a47262bf6909dee878
SHA1

c2675a34536fbb0e637b3b63ca5671f93a7f9484
SHA256

0a38204354bdd03ca06520f5482cc057a926eef96944a2a179c370b9f64f4842
SHA512

7f5ac9a34891642b056cd37c0f54c3cc86caab581df6a4d62d1279efe38449b0bc63bbd305eecaf382fadba7022c6791293711ec9855920dbf82a0a07347a80d
SSDEEP

24576:WbTUojyk1O/sDcxLx+gGBWDvKe0VR7Ev3b7YpQKZ445fm:gy7Gs78V9Ev3fYpvf

Score

10^/10

Family

danabot

58.58.210.181

222.175.52.161

149.53.185.172

81.63.70.192

195.123.246.209

149.154.159.213

2.255.189.191

187.198.70.207

139.113.48.33

244.28.200.120

rsa_pubkey.plain

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot x86 payload 1 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
botnet

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\7EFDCE~1.DLL family_danabot
Blocklisted process makes network request 9 IoCs

Processes:

rundll32.exe

flow pid process

2 2304 rundll32.exe
3 2304 rundll32.exe
4 2304 rundll32.exe
5 2304 rundll32.exe
6 2304 rundll32.exe
9 2304 rundll32.exe
12 2304 rundll32.exe
15 2304 rundll32.exe
16 2304 rundll32.exe
Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

2620 regsvr32.exe
Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

2620 regsvr32.exe
2304 rundll32.exe
2304 rundll32.exe
2304 rundll32.exe
2304 rundll32.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7EFDCE~1.DLL	family_danabot

pid	process
2620	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exeregsvr32.exe

description	pid	process	target process
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	regsvr32.exe
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	regsvr32.exe
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	regsvr32.exe
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	regsvr32.exe
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	regsvr32.exe
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	regsvr32.exe
PID 1612 wrote to memory of 2620	1612	7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe	regsvr32.exe
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	rundll32.exe
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	rundll32.exe
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	rundll32.exe
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	rundll32.exe
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	rundll32.exe
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	rundll32.exe
PID 2620 wrote to memory of 2304	2620	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7efdce6925f9d0a47262bf6909dee878_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\7EFDCE~1.DLL
Filesize
630KB

MD5
c7eb2bf31aff077a631dd3f03056286c

SHA1
76912c777b3e53b5a90be26d7a8792c9bc743a86

SHA256
b25936459bd7f0b8b0c8157e20841fbbf0115ac6d09132cfb22aadae763224f0

SHA512
6035ad5beb0b51fe400a156b6519b8e8c53886ad0833ee74673c22570ba8a3f443f1a82babe033e5aa6d5f8dfb1f50dde3f3b90b4a9bc0fc9c517bc1c7d1e8bd

Download Submit
memory/1612-1-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2304-8-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download
memory/2304-9-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download
memory/2304-11-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download
memory/2304-13-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download