Analysis
-
max time kernel
140s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 18:32
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832.exe
-
Size
1.3MB
-
MD5
43d4f3a5fc326959c703c8abc262ebe4
-
SHA1
ac6b43e9fe252d10fa13352ce9828c86b557406f
-
SHA256
d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832
-
SHA512
7d302a4720afb69a77c31300785c10725a031f9300bef84ce3de7102b9b6f350b40730904dc7e3fd1d74544b9075ed5606b1ebbc117c08b53f36f9ad8e6a3f4a
-
SSDEEP
24576:vuCzz4KK5Rw5RN4txG8M3/yizLUO15K/BmeU8LyYzlgkHQd:r4KORwd4y8M3/yc5ume/LYk
Malware Config
Extracted
danabot
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
-
Danabot family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdapterTroubleshooter.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2604 3068 JaffaCakes118_d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832.exe 29 PID 3068 wrote to memory of 2604 3068 JaffaCakes118_d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832.exe 29 PID 3068 wrote to memory of 2604 3068 JaffaCakes118_d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832.exe 29 PID 3068 wrote to memory of 2604 3068 JaffaCakes118_d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d480cefe3a7c8b211c1b3ddfa92e65aa9fc782403642676efd9466ac9519a832.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\AdapterTroubleshooter.exeC:\Windows\system32\AdapterTroubleshooter.exe2⤵
- System Location Discovery: System Language Discovery
PID:2604
-