Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c4096c84db0b416d27c1aa704c6d4945_JaffaCakes118.dll
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
c4096c84db0b416d27c1aa704c6d4945_JaffaCakes118.dll
-
Size
608KB
-
MD5
c4096c84db0b416d27c1aa704c6d4945
-
SHA1
48fc787d3d0b7a1f30f058b925291e4d9fc1e846
-
SHA256
6138804cc7d09d1855ffb4655e4129e1300287d78ffefebc773689651a87e4cd
-
SHA512
619e672be2c9645f1243bcb3ea2e8d73dd8b3f4eace06f812ffa506eebe8e57ccbfaf72ba8e7216e2077b9d2898520b547818eb34f7c69479bc8dc376787254c
-
SSDEEP
12288:NZGQdqOGIqJqydLqQSeCqsVK8kPRGO35N9mVyzXc6:NZ0TWjeCVVK8kP9N9o2
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 1156 rundll32.exe 5 1156 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2072 wrote to memory of 1156 2072 rundll32.exe 28 PID 2072 wrote to memory of 1156 2072 rundll32.exe 28 PID 2072 wrote to memory of 1156 2072 rundll32.exe 28 PID 2072 wrote to memory of 1156 2072 rundll32.exe 28 PID 2072 wrote to memory of 1156 2072 rundll32.exe 28 PID 2072 wrote to memory of 1156 2072 rundll32.exe 28 PID 2072 wrote to memory of 1156 2072 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4096c84db0b416d27c1aa704c6d4945_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4096c84db0b416d27c1aa704c6d4945_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
PID:1156
-