Analysis
-
max time kernel
142s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 00:45
Static task
static1
Behavioral task
behavioral1
Sample
7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7ef8cd0a29c3dfa39a5a98cf7c086ae9
-
SHA1
b6f558f6460c3fdd0029860e38a08eee31941c01
-
SHA256
1322ae78c8352abc316a3ec642f8acf7a0187d2796bfd67c53fd64722bdcba6d
-
SHA512
d8a8d6fc34003d726ccd16bc1dabde97d63bcb32d5714478b08c98d6237fa06cffeb79ce9c51c1e11e6a00e96fa0a6df90ced26f6e51a3ff70626d0f67704483
-
SSDEEP
24576:S8r6tuuWnigUAOJtWmEBMoBBX3muHJ1JD:+FlznPWmEaonX3pH
Malware Config
Extracted
danabot
149.154.159.213
221.11.15.186
140.200.163.110
238.214.73.11
77.163.235.35
151.236.14.84
204.201.196.112
43.150.102.9
115.91.243.217
198.6.155.175
Signatures
-
Blocklisted process makes network request 9 IoCs
Processes:
rundll32.exeflow pid process 11 1712 rundll32.exe 30 1712 rundll32.exe 44 1712 rundll32.exe 49 1712 rundll32.exe 53 1712 rundll32.exe 54 1712 rundll32.exe 55 1712 rundll32.exe 71 1712 rundll32.exe 72 1712 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2968 4824 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 60 wrote to memory of 4824 60 rundll32.exe rundll32.exe PID 60 wrote to memory of 4824 60 rundll32.exe rundll32.exe PID 60 wrote to memory of 4824 60 rundll32.exe rundll32.exe PID 4824 wrote to memory of 1712 4824 rundll32.exe rundll32.exe PID 4824 wrote to memory of 1712 4824 rundll32.exe rundll32.exe PID 4824 wrote to memory of 1712 4824 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,f03⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 8163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4824 -ip 48241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1712-29-0x00000000020A0000-0x00000000021D5000-memory.dmpFilesize
1.2MB
-
memory/1712-25-0x00000000020A0000-0x00000000021D5000-memory.dmpFilesize
1.2MB
-
memory/1712-43-0x00000000020A0000-0x00000000021D5000-memory.dmpFilesize
1.2MB
-
memory/1712-37-0x00000000020A0000-0x00000000021D5000-memory.dmpFilesize
1.2MB
-
memory/1712-36-0x0000000002830000-0x0000000002836000-memory.dmpFilesize
24KB
-
memory/1712-34-0x00000000020A0000-0x00000000021D5000-memory.dmpFilesize
1.2MB
-
memory/1712-45-0x00000000020A0000-0x00000000021D5000-memory.dmpFilesize
1.2MB
-
memory/1712-28-0x0000000002830000-0x0000000002836000-memory.dmpFilesize
24KB
-
memory/1712-17-0x00000000020A0000-0x00000000021D5000-memory.dmpFilesize
1.2MB
-
memory/1712-16-0x00000000020A0000-0x00000000021D5000-memory.dmpFilesize
1.2MB
-
memory/1712-27-0x00000000007A0000-0x00000000007A6000-memory.dmpFilesize
24KB
-
memory/1712-21-0x0000000000690000-0x0000000000696000-memory.dmpFilesize
24KB
-
memory/1712-22-0x0000000000790000-0x0000000000796000-memory.dmpFilesize
24KB
-
memory/1712-24-0x00000000020A0000-0x00000000021D5000-memory.dmpFilesize
1.2MB
-
memory/4824-9-0x00000000022F0000-0x0000000002425000-memory.dmpFilesize
1.2MB
-
memory/4824-14-0x00000000022F0000-0x0000000002425000-memory.dmpFilesize
1.2MB
-
memory/4824-12-0x0000000000AF0000-0x0000000000AF6000-memory.dmpFilesize
24KB
-
memory/4824-0-0x00000000022F0000-0x0000000002425000-memory.dmpFilesize
1.2MB
-
memory/4824-32-0x00000000022F0000-0x0000000002425000-memory.dmpFilesize
1.2MB
-
memory/4824-33-0x0000000000AF0000-0x0000000000AF6000-memory.dmpFilesize
24KB
-
memory/4824-11-0x0000000000AE0000-0x0000000000AE6000-memory.dmpFilesize
24KB
-
memory/4824-8-0x0000000000AD0000-0x0000000000AD6000-memory.dmpFilesize
24KB
-
memory/4824-6-0x00000000022F0000-0x0000000002425000-memory.dmpFilesize
1.2MB
-
memory/4824-5-0x0000000000AC0000-0x0000000000AC6000-memory.dmpFilesize
24KB
-
memory/4824-1-0x00000000022F0000-0x0000000002425000-memory.dmpFilesize
1.2MB