Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 02:46
Behavioral task
behavioral1
Sample
e909268babd8038ecfba09759ce45fbe_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
e909268babd8038ecfba09759ce45fbe_JaffaCakes118.dll
-
Size
1.3MB
-
MD5
e909268babd8038ecfba09759ce45fbe
-
SHA1
c32c85993a51dc0273ab0565904e79a5561364f8
-
SHA256
6ebbc1b9edb101e23b574745b7a3973f6d29209bc53082486b2e76092b647fbe
-
SHA512
a8941f8d0bae7860a001aa0d1e2b16580773c7cd19d7da413042600dd122a16a5d1967c39cafc76a0489bb91ef9412729ae2efb5e3464b49953809aab5ec2c16
-
SSDEEP
24576:kcF2VtrZmrDEtLk7Kd/FFdf+BawXHvJbSc9W0wTR7McbtV:HzyFJ+3Sc9W0wT5Mo
Malware Config
Extracted
Family
danabot
Botnet
4
C2
5.9.224.204:443
192.210.222.81:443
23.229.29.48:443
Attributes
-
embedded_hash
%20252;2E2J2O2[2a2f2m2s2x2}2�2�2�
-
type
loader
Signatures
-
Danabot Loader Component 15 IoCs
Processes:
resource yara_rule behavioral1/memory/3000-0-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-1-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-2-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-3-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-4-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-5-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-6-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-7-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-8-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-9-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-10-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-11-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-12-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-13-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 behavioral1/memory/3000-14-0x0000000000430000-0x0000000000591000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 3000 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1984 wrote to memory of 3000 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 3000 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 3000 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 3000 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 3000 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 3000 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 3000 1984 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e909268babd8038ecfba09759ce45fbe_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e909268babd8038ecfba09759ce45fbe_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3000-0-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-1-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-2-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-3-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-4-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-5-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-6-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-7-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-8-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-9-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-10-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-11-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-12-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-13-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB
-
memory/3000-14-0x0000000000430000-0x0000000000591000-memory.dmpFilesize
1.4MB