Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 04:13
Behavioral task
behavioral1
Sample
ca897b6bc116957e7069021eecbd4e76_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
ca897b6bc116957e7069021eecbd4e76_JaffaCakes118.dll
-
Size
1.3MB
-
MD5
ca897b6bc116957e7069021eecbd4e76
-
SHA1
0932c90275d2339c29f572dcfe16af33d24500cb
-
SHA256
1488bcae87c39c987f3f303e20af0f47cefdbf11740c13ac7fc09be83d95628d
-
SHA512
e96e7a3fc0bda168e5305a812cc3248d10f36f3d29b2e7f1b343ae7f585981ad71417f88d95711941a6f573b28989f46391c8ff44a9cc1e3e0878e9d0b98ebd4
-
SSDEEP
24576:z8pWEmCxRJvbip/sVJ5u5+JAMh9sweYgoGZH4vQrTIZMb77Qz:YfNJAMh9ynh4vQrTkn
Malware Config
Extracted
danabot
4
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
-
Danabot Loader Component 15 IoCs
Processes:
resource yara_rule behavioral1/memory/1680-0-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-1-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-2-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-3-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-4-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-5-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-6-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-7-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-8-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-9-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-10-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-11-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-12-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-13-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 behavioral1/memory/1680-14-0x00000000020F0000-0x0000000002252000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 1680 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2364 wrote to memory of 1680 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 1680 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 1680 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 1680 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 1680 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 1680 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 1680 2364 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca897b6bc116957e7069021eecbd4e76_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca897b6bc116957e7069021eecbd4e76_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1680-0-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-1-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-2-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-3-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-4-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-5-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-6-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-7-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-8-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-9-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-10-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-11-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-12-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-13-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB
-
memory/1680-14-0x00000000020F0000-0x0000000002252000-memory.dmpFilesize
1.4MB