Analysis
-
max time kernel
157s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-04-2024 16:24
General
-
Target
edd988205ba5cd316b4321a77d5811d3_JaffaCakes118.dll
-
Size
1.3MB
-
MD5
edd988205ba5cd316b4321a77d5811d3
-
SHA1
7a023b0bc5cb613307c97bca673d6422569762ba
-
SHA256
b13a39af4ec228e24e9dec94878cb4f84b99818810c25d3f4f9c0ebda94783fa
-
SHA512
0b8cf0b8866fd51ad039fc43b7ae69e91a0d183104baf03a99d5dc75f3d4dfcd152f5b94ace5600ae9e6c5d229a52ee48e5f930971e727ac193ac10d5be7f985
-
SSDEEP
24576:a8FPiO/eO4ES4b5aRyYhQv54aMsFhAF9ATmwMPGA:BRtRb5R4vsA9ATFMP
Score
10/10
Malware Config
Extracted
Family
danabot
Botnet
15
C2
192.52.166.169:443
173.254.204.95:443
192.52.167.45:443
Attributes
-
embedded_hash
D6A9A294BFDC6F13BFCC2AB0FA9B54B9
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Danabot Loader Component 14 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\edd988205ba5cd316b4321a77d5811d3_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\edd988205ba5cd316b4321a77d5811d3_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB