Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2025, 22:20
Behavioral task
behavioral1
Sample
JaffaCakes118_d3c7d783198caf5baba9509981592fbb.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_d3c7d783198caf5baba9509981592fbb.dll
-
Size
1.3MB
-
MD5
d3c7d783198caf5baba9509981592fbb
-
SHA1
49fe8f8358b22eb10f9062356b8c45204a7a2a27
-
SHA256
cb1f68ed48ce21437fb3ac3b1cf1059f291bba5fbb06ed01822ec747ac1c1ebf
-
SHA512
84aa91919b2d0d0c24a08582ad6638cba2af3e9f953ea63e3c02db0fd07dae06d387d49131071c0eae8480a0e5c154b2fda79ba89a06d756d5b67f63e290f656
-
SSDEEP
24576:9cF2xuuTPu3KkS4TAWYHOy0WCl2oTU4F9f+tS:+66nYugCpTDHf+t
Malware Config
Extracted
danabot
4
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
-
Danabot Loader Component 14 IoCs
resource yara_rule behavioral2/memory/1224-0-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-1-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-2-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-3-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-4-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-5-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-6-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-7-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-8-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-9-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-10-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-11-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-12-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/1224-13-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1224 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2836 wrote to memory of 1224 2836 rundll32.exe 86 PID 2836 wrote to memory of 1224 2836 rundll32.exe 86 PID 2836 wrote to memory of 1224 2836 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d3c7d783198caf5baba9509981592fbb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d3c7d783198caf5baba9509981592fbb.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:1224
-