Analysis
- max time kernel
142s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
29/05/2024, 00:45
General
- Target 7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll
- Size 1.2MB
- Sample240529-a4je2sbc71
- SHA256 1322ae78c8352abc316a3ec642f8acf7a0187d2796bfd67c53fd64722bdcba6d
Malware Config
Extracted
-
danabot
-
149.154.159.213
-
221.11.15.186
-
140.200.163.110
-
238.214.73.11
-
77.163.235.35
-
151.236.14.84
-
204.201.196.112
-
43.150.102.9
-
115.91.243.217
-
198.6.155.175
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Blocklisted process makes network request 9 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,f03⤵
- Blocklisted process makes network request
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 8163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4824 -ip 48241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1712-29-0x00000000020A0000-0x00000000021D5000-memory.dmp
memory/1712-22-0x0000000000790000-0x0000000000796000-memory.dmp
memory/1712-43-0x00000000020A0000-0x00000000021D5000-memory.dmp
memory/1712-37-0x00000000020A0000-0x00000000021D5000-memory.dmp
memory/1712-36-0x0000000002830000-0x0000000002836000-memory.dmp
memory/1712-34-0x00000000020A0000-0x00000000021D5000-memory.dmp
memory/1712-27-0x00000000007A0000-0x00000000007A6000-memory.dmp
memory/1712-25-0x00000000020A0000-0x00000000021D5000-memory.dmp
memory/1712-45-0x00000000020A0000-0x00000000021D5000-memory.dmp
memory/1712-16-0x00000000020A0000-0x00000000021D5000-memory.dmp
memory/1712-17-0x00000000020A0000-0x00000000021D5000-memory.dmp
memory/1712-21-0x0000000000690000-0x0000000000696000-memory.dmp
memory/1712-28-0x0000000002830000-0x0000000002836000-memory.dmp
memory/1712-24-0x00000000020A0000-0x00000000021D5000-memory.dmp
memory/4824-9-0x00000000022F0000-0x0000000002425000-memory.dmp
memory/4824-14-0x00000000022F0000-0x0000000002425000-memory.dmp
memory/4824-12-0x0000000000AF0000-0x0000000000AF6000-memory.dmp
memory/4824-0-0x00000000022F0000-0x0000000002425000-memory.dmp
memory/4824-32-0x00000000022F0000-0x0000000002425000-memory.dmp
memory/4824-33-0x0000000000AF0000-0x0000000000AF6000-memory.dmp
memory/4824-11-0x0000000000AE0000-0x0000000000AE6000-memory.dmp
memory/4824-8-0x0000000000AD0000-0x0000000000AD6000-memory.dmp
memory/4824-6-0x00000000022F0000-0x0000000002425000-memory.dmp
memory/4824-5-0x0000000000AC0000-0x0000000000AC6000-memory.dmp
memory/4824-1-0x00000000022F0000-0x0000000002425000-memory.dmp