Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2024 07:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ece9fd176f4a88fe71e1fe92168846b6_JaffaCakes118.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
ece9fd176f4a88fe71e1fe92168846b6_JaffaCakes118.dll
-
Size
188KB
-
MD5
ece9fd176f4a88fe71e1fe92168846b6
-
SHA1
507ea643b9eb198dc81d930a6f448a082767f446
-
SHA256
9b70a0501c2f920b9885e78e389268a241f4e88eb161d9cf434915c03d7d4695
-
SHA512
92caade81969ee51ab605fb05f447d30f1b4d8ff3ad9f5faa0dc131110b097d84da2f64f204d7414f8b093d4ee3f4a07f1870adedf56e3b2b61c61f2bcda0198
-
SSDEEP
3072:FA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAo6o:FzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4188-1-0x0000000075450000-0x0000000075480000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1976 4188 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 772 wrote to memory of 4188 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 4188 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 4188 772 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ece9fd176f4a88fe71e1fe92168846b6_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ece9fd176f4a88fe71e1fe92168846b6_JaffaCakes118.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 6883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4188 -ip 41881⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵