Analysis
-
max time kernel
48s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fde6b5be428ee0956ab4ef231ed21dd7_JaffaCakes118.dll
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
fde6b5be428ee0956ab4ef231ed21dd7_JaffaCakes118.dll
-
Size
175KB
-
MD5
fde6b5be428ee0956ab4ef231ed21dd7
-
SHA1
a223c73bdf81d1cee58b20bfaeab412c0b2a99d9
-
SHA256
b60c01e98969144fc8d3229a9d3b82de13879444d91f558ea4483547141b85a5
-
SHA512
9f5de9a37e2e61622d2d1c8e8c52d39f782c093d64feeffd5fc3b7f5a53f8258a80a274c58a4d15651c8e1c4f219a7856aa5f864b449ffc9d2c6566ad6a0209e
-
SSDEEP
3072:WiY5bY8XE+kkqh84cKcv4FinaLzL2rVQLOmpvNbTAv7stOr18T:JRAkkk84e4wne2nmhFAv74O
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
45.79.33.48:443
139.162.202.74:5007
68.183.216.174:7443
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/5060-0-0x0000000075030000-0x0000000075060000-memory.dmp dridex_ldr behavioral2/memory/5060-2-0x0000000075030000-0x0000000075060000-memory.dmp dridex_ldr -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1736 wrote to memory of 5060 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 5060 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 5060 1736 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fde6b5be428ee0956ab4ef231ed21dd7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fde6b5be428ee0956ab4ef231ed21dd7_JaffaCakes118.dll,#12⤵
- Checks whether UAC is enabled