Analysis
-
max time kernel
141s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07-01-2025 06:34
Behavioral task
behavioral1
Sample
JaffaCakes118_52f4174dad94afe8ebab2ad26e48720b.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_52f4174dad94afe8ebab2ad26e48720b.dll
-
Size
1.3MB
-
MD5
52f4174dad94afe8ebab2ad26e48720b
-
SHA1
a630b88f3870dbbc8a0bc41ead9c555c86744a2d
-
SHA256
6fd412b24c94302c0c556fd80075146074e01eb0d83bb87f01a20d181201188d
-
SHA512
933bb24aed78395df2d5a58d09bdb0040a1db173ec157001be6d54459175c39d3aaf01dd0f5386239d3122948ec2ac33e2489d8a6074d00038ccbfffcfbfb38f
-
SSDEEP
24576:/8pWEm4bqFd1leD0o8WVVld/uCNZCT0dCIQb:UcynDP/7ZCTOQb
Malware Config
Extracted
danabot
4
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
-
Danabot Loader Component 15 IoCs
resource yara_rule behavioral1/memory/636-0-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-1-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-2-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-3-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-4-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-5-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-6-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-7-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-8-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-9-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-10-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-11-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-12-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-13-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 behavioral1/memory/636-14-0x0000000000890000-0x00000000009F2000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 636 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 432 wrote to memory of 636 432 rundll32.exe 29 PID 432 wrote to memory of 636 432 rundll32.exe 29 PID 432 wrote to memory of 636 432 rundll32.exe 29 PID 432 wrote to memory of 636 432 rundll32.exe 29 PID 432 wrote to memory of 636 432 rundll32.exe 29 PID 432 wrote to memory of 636 432 rundll32.exe 29 PID 432 wrote to memory of 636 432 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52f4174dad94afe8ebab2ad26e48720b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52f4174dad94afe8ebab2ad26e48720b.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:636
-