Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-04-2024 05:14
Behavioral task
behavioral1
Sample
e6b5572e56e33102ab37332767d95952_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e6b5572e56e33102ab37332767d95952_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e6b5572e56e33102ab37332767d95952_JaffaCakes118.dll
-
Size
124KB
-
MD5
e6b5572e56e33102ab37332767d95952
-
SHA1
5866b15b2985b7f53d1d44d5e6899beb631c15a1
-
SHA256
a92dbfd52b23a42020e4470ffa8b3dd1199acfad7a84dae298a047b904f31710
-
SHA512
1cef3bf717247c87efed9f5467ee733584b83126cf6c18fae6d187a8bb5666ad65dc16f0c93f120ec45362e7f3c0860dd66f6030574faf99f02583253bbfdb34
-
SSDEEP
3072:eeZmogDk+IWT1+LAAUr8SpQMQ2TRvpAlLEE8G9:eeZkgHWmAKcRvml
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2296-0-0x0000000000180000-0x00000000001A4000-memory.dmp amadey_cred_module -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2296 rundll32.exe 2296 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2176 wrote to memory of 2296 2176 rundll32.exe rundll32.exe PID 2176 wrote to memory of 2296 2176 rundll32.exe rundll32.exe PID 2176 wrote to memory of 2296 2176 rundll32.exe rundll32.exe PID 2176 wrote to memory of 2296 2176 rundll32.exe rundll32.exe PID 2176 wrote to memory of 2296 2176 rundll32.exe rundll32.exe PID 2176 wrote to memory of 2296 2176 rundll32.exe rundll32.exe PID 2176 wrote to memory of 2296 2176 rundll32.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e6b5572e56e33102ab37332767d95952_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e6b5572e56e33102ab37332767d95952_JaffaCakes118.dll,#12⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:2296