Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-10-2024 19:15
Behavioral task
behavioral1
Sample
7c78ae858428ac02da45b13383079fd1_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
7c78ae858428ac02da45b13383079fd1_JaffaCakes118.dll
-
Size
1.3MB
-
MD5
7c78ae858428ac02da45b13383079fd1
-
SHA1
9fc998289238eba8b666bef44e082fb7d2d18470
-
SHA256
67bfa0e43f05cec60573d694c8bd436165564b86578e56151cd2c6b92763f3c2
-
SHA512
8a47c7fa0ec82c16aa71f9689f2665d71c1f8fd9eafedb189d0e3a2c667e4f201cdf6e53e2d0166153d425ecde065656f00f11b580151500bd0f1ed82b523d5d
-
SSDEEP
24576:EcFXBYTSN1OnvLspGma0nlMp9/coexBhpE9PiTPXP:ntGKnlMpd9eHTn
Malware Config
Extracted
Family
danabot
Botnet
4
C2
142.11.244.124:443
142.11.206.50:443
Attributes
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 15 IoCs
resource yara_rule behavioral1/memory/2364-0-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-1-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-2-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-3-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-4-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-5-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-6-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-7-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-8-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-9-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-10-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-11-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-12-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-13-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 behavioral1/memory/2364-14-0x0000000002040000-0x000000000219C000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2364 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2364 3064 rundll32.exe 30 PID 3064 wrote to memory of 2364 3064 rundll32.exe 30 PID 3064 wrote to memory of 2364 3064 rundll32.exe 30 PID 3064 wrote to memory of 2364 3064 rundll32.exe 30 PID 3064 wrote to memory of 2364 3064 rundll32.exe 30 PID 3064 wrote to memory of 2364 3064 rundll32.exe 30 PID 3064 wrote to memory of 2364 3064 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c78ae858428ac02da45b13383079fd1_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c78ae858428ac02da45b13383079fd1_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2364
-