Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-01-2025 17:04
Behavioral task
behavioral1
Sample
JaffaCakes118_e97e706ef6e7d45d0e0872c2242a0c6a.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_e97e706ef6e7d45d0e0872c2242a0c6a.dll
-
Size
1.3MB
-
MD5
e97e706ef6e7d45d0e0872c2242a0c6a
-
SHA1
10510ac56c25cfca0d82c6bce606b5ba7766df53
-
SHA256
1a4add1669f98ec6131aa854163d4263d0f209721a80d5eea95ad3e5fe95799f
-
SHA512
f2797b874108a4a1bb53b54565df6220b52011fb87fdec06de04bbfec001fcb8249233504898763e2cb5499a8b2e5fa3e57348d34061fa93573ba02b3a824922
-
SSDEEP
24576:x8FGMpHdFpe260FF+GlerIW1wK5//KIBtETOGekn1:yJdNl2IWqKdiuETxeW
Malware Config
Extracted
danabot
4
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
-
Danabot Loader Component 15 IoCs
resource yara_rule behavioral1/memory/1200-0-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-1-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-2-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-3-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-4-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-5-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-6-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-7-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-8-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-9-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-10-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-11-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-12-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-13-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 behavioral1/memory/1200-14-0x0000000002010000-0x0000000002170000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 1200 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1200 2348 rundll32.exe 31 PID 2348 wrote to memory of 1200 2348 rundll32.exe 31 PID 2348 wrote to memory of 1200 2348 rundll32.exe 31 PID 2348 wrote to memory of 1200 2348 rundll32.exe 31 PID 2348 wrote to memory of 1200 2348 rundll32.exe 31 PID 2348 wrote to memory of 1200 2348 rundll32.exe 31 PID 2348 wrote to memory of 1200 2348 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e97e706ef6e7d45d0e0872c2242a0c6a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e97e706ef6e7d45d0e0872c2242a0c6a.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:1200
-