Analysis
-
max time kernel
142s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7ef8cd0a29c3dfa39a5a98cf7c086ae9
-
SHA1
b6f558f6460c3fdd0029860e38a08eee31941c01
-
SHA256
1322ae78c8352abc316a3ec642f8acf7a0187d2796bfd67c53fd64722bdcba6d
-
SHA512
d8a8d6fc34003d726ccd16bc1dabde97d63bcb32d5714478b08c98d6237fa06cffeb79ce9c51c1e11e6a00e96fa0a6df90ced26f6e51a3ff70626d0f67704483
-
SSDEEP
24576:S8r6tuuWnigUAOJtWmEBMoBBX3muHJ1JD:+FlznPWmEaonX3pH
Malware Config
Extracted
Family
danabot
C2
149.154.159.213
221.11.15.186
140.200.163.110
238.214.73.11
77.163.235.35
151.236.14.84
204.201.196.112
43.150.102.9
115.91.243.217
198.6.155.175
rsa_pubkey.plain
Signatures
-
Blocklisted process makes network request 9 IoCs
flow pid Process 11 1712 rundll32.exe 30 1712 rundll32.exe 44 1712 rundll32.exe 49 1712 rundll32.exe 53 1712 rundll32.exe 54 1712 rundll32.exe 55 1712 rundll32.exe 71 1712 rundll32.exe 72 1712 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2968 4824 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 60 wrote to memory of 4824 60 rundll32.exe 83 PID 60 wrote to memory of 4824 60 rundll32.exe 83 PID 60 wrote to memory of 4824 60 rundll32.exe 83 PID 4824 wrote to memory of 1712 4824 rundll32.exe 84 PID 4824 wrote to memory of 1712 4824 rundll32.exe 84 PID 4824 wrote to memory of 1712 4824 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,f03⤵
- Blocklisted process makes network request
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 8163⤵
- Program crash
PID:2968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4824 -ip 48241⤵PID:4280