Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 00:12
Static task
static1
Behavioral task
behavioral1
Sample
efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
efd88b54cb2cb7330c632e3602c2ae58
-
SHA1
9049eda2cee0cef67702773404d41b9e3f8958e3
-
SHA256
9649af1104cfd972e86b047703fe04b3ae21ff4620754d91cba542fa33a59bc0
-
SHA512
bb80d442106536f03ed665ba89eab0320d1e2f37faaf4efbdca54b6dd2610dde1c929786f687358da795baca76dc73a94e689c8f3775e755f39b4fde8f4c3562
-
SSDEEP
24576:hKsIfstD6iQybmavixH7K0FVMtnRSY5EmVRL4DGrQn3N:H/QySmf0FVM0qrQ9
Malware Config
Extracted
danabot
4
142.11.244.124:443
142.11.206.50:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Signatures
-
Danabot Loader Component 11 IoCs
Processes:
resource yara_rule behavioral1/memory/2988-9-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 \Users\Admin\AppData\Local\Temp\EFD88B~1.TMP DanabotLoader2021 behavioral1/memory/2988-12-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 behavioral1/memory/2988-20-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 behavioral1/memory/2988-21-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 behavioral1/memory/2988-22-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 behavioral1/memory/2988-23-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 behavioral1/memory/2988-24-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 behavioral1/memory/2988-25-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 behavioral1/memory/2988-26-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 behavioral1/memory/2988-27-0x0000000001F50000-0x00000000020AF000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 2988 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2988 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exedescription pid process target process PID 2212 wrote to memory of 2988 2212 efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe rundll32.exe PID 2212 wrote to memory of 2988 2212 efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe rundll32.exe PID 2212 wrote to memory of 2988 2212 efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe rundll32.exe PID 2212 wrote to memory of 2988 2212 efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe rundll32.exe PID 2212 wrote to memory of 2988 2212 efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe rundll32.exe PID 2212 wrote to memory of 2988 2212 efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe rundll32.exe PID 2212 wrote to memory of 2988 2212 efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\efd88b54cb2cb7330c632e3602c2ae58_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\EFD88B~1.TMP,S C:\Users\Admin\AppData\Local\Temp\EFD88B~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\EFD88B~1.TMPFilesize
1.3MB
MD55f47b2e2cdf0d06c448b5e5d2ef104f5
SHA18424ffbd785260617369c8697f19bdfccb37f10b
SHA256c1da55d915e13a88e33222821397da73a176473d634b8d4015cc2487c3f5f342
SHA512336cc8952f1081b961a98f919c239961c8e69003002e07a1794307dd62f733574685b309837f788f71a7febb45b7ac58dfcce7954c1776c636440400cdec47b5
-
memory/2212-11-0x0000000000220000-0x000000000030A000-memory.dmpFilesize
936KB
-
memory/2212-6-0x0000000000400000-0x0000000003326000-memory.dmpFilesize
47.1MB
-
memory/2212-0-0x0000000000220000-0x000000000030A000-memory.dmpFilesize
936KB
-
memory/2212-10-0x0000000003330000-0x000000000342F000-memory.dmpFilesize
1020KB
-
memory/2212-2-0x0000000003330000-0x000000000342F000-memory.dmpFilesize
1020KB
-
memory/2212-1-0x0000000000220000-0x000000000030A000-memory.dmpFilesize
936KB
-
memory/2212-5-0x0000000000400000-0x0000000003326000-memory.dmpFilesize
47.1MB
-
memory/2988-9-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB
-
memory/2988-21-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB
-
memory/2988-20-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB
-
memory/2988-12-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB
-
memory/2988-22-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB
-
memory/2988-23-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB
-
memory/2988-24-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB
-
memory/2988-25-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB
-
memory/2988-26-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB
-
memory/2988-27-0x0000000001F50000-0x00000000020AF000-memory.dmpFilesize
1.4MB