Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 15:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f841b393832ad49cd46c79fdc9c1fc24_JaffaCakes118.dll
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
f841b393832ad49cd46c79fdc9c1fc24_JaffaCakes118.dll
-
Size
188KB
-
MD5
f841b393832ad49cd46c79fdc9c1fc24
-
SHA1
5194d105af93b7568d80dcf4232d55fe34c604fa
-
SHA256
525a05000508a92b32699e45809cccbc23c1e34c22d0f62cc9019a030e720a39
-
SHA512
37ee0522b0efc21d4070d7135c033170689b13eea0c0e2c02c3ed80f7c3c8cb04543f8cf5340327b784e3e6a3f73d656292ad2cfc5f5659286a7be01cfad330d
-
SSDEEP
3072:PA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAojo:PzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2140-0-0x00000000753E0000-0x0000000075410000-memory.dmp dridex_ldr -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2144 2140 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1920 wrote to memory of 2140 1920 rundll32.exe rundll32.exe PID 1920 wrote to memory of 2140 1920 rundll32.exe rundll32.exe PID 1920 wrote to memory of 2140 1920 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f841b393832ad49cd46c79fdc9c1fc24_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f841b393832ad49cd46c79fdc9c1fc24_JaffaCakes118.dll,#12⤵PID:2140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 6883⤵
- Program crash
PID:2144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2140 -ip 21401⤵PID:4216