Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2025 07:33
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_de8b54a938ac18f15cad804d79a0e19d.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_de8b54a938ac18f15cad804d79a0e19d.dll
-
Size
2.5MB
-
MD5
de8b54a938ac18f15cad804d79a0e19d
-
SHA1
b6004c62e2d9dbad9cfd5f7e18647ac983788766
-
SHA256
2a3acdcd76575762b18c18c644a745125f55ce121f742d2aad962521bc7f25fd
-
SHA512
7b64a99baafc8e692a47b9856f96b6bafa3cae22bd293c0e8faf148bdfe3f1401d5c316017b5c2f778d02ebc87edd2474e525b225ddc00685bb14da4c484e776
-
SSDEEP
49152:ZgZziYTt//YDt2Z/fZMdzUAOC5n+LlrxFTGWgKq:Z0ziYTKh2Z/f6AAOGarxFTG/v
Malware Config
Extracted
danabot
40
185.158.250.216:443
194.76.225.46:443
45.11.180.153:443
194.76.225.61:443
-
embedded_hash
AD14EA44261341E3690FA8CC1E236523
-
type
loader
Signatures
-
Danabot Loader Component 16 IoCs
resource yara_rule behavioral2/memory/3696-3-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-7-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-8-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-9-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-10-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-11-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-12-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-13-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-14-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-15-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-16-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-17-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-18-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-19-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-20-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 behavioral2/memory/3696-21-0x0000000074C80000-0x0000000074F0E000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 17 3696 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4764 wrote to memory of 3696 4764 rundll32.exe 84 PID 4764 wrote to memory of 3696 4764 rundll32.exe 84 PID 4764 wrote to memory of 3696 4764 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de8b54a938ac18f15cad804d79a0e19d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de8b54a938ac18f15cad804d79a0e19d.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3696
-