Analysis
- max time kernel
149s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
06/05/2024, 01:37
General
- Target 1a284e601d4b39b13a2c1ea67fe0433b_JaffaCakes118.dll
- Size 986KB
- Sample240506-b2cedsfh27
- SHA256 3b7790a2520c63e35ddae8ac5a3aed6c09b16a1a3506d414c6aedfc65cba9b34
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a284e601d4b39b13a2c1ea67fe0433b_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemSettingsAdminFlows.exeC:\Windows\system32\SystemSettingsAdminFlows.exe1⤵
-
C:\Users\Admin\AppData\Local\Sso8n7qgT\SystemSettingsAdminFlows.exeC:\Users\Admin\AppData\Local\Sso8n7qgT\SystemSettingsAdminFlows.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\GmB\rdpshell.exeC:\Users\Admin\AppData\Local\GmB\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\C2Yex\SppExtComObj.ExeC:\Users\Admin\AppData\Local\C2Yex\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ACTIVEDS.dll
SppExtComObj.Exe
dwmapi.dll
rdpshell.exe
DUI70.dll
SystemSettingsAdminFlows.exe
Puokv.lnk
memory/3436-7-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/3436-33-0x00007FF8E3910000-0x00007FF8E3920000-memory.dmp
memory/3436-11-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/3436-10-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/3436-9-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/3436-8-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/3436-14-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/3436-4-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/3436-34-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/3436-6-0x00007FF8E308A000-0x00007FF8E308B000-memory.dmp
memory/3436-32-0x0000000000780000-0x0000000000787000-memory.dmp
memory/3436-12-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/3436-13-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/3436-23-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/4524-83-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4616-37-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/4616-0-0x000001ABF6A80000-0x000001ABF6A87000-memory.dmp
memory/4616-1-0x0000000140000000-0x00000001400FC000-memory.dmp
memory/5724-64-0x000001757C100000-0x000001757C107000-memory.dmp
memory/5724-61-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/5724-67-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/5768-50-0x0000000140000000-0x0000000140142000-memory.dmp
memory/5768-47-0x000002D4E9B00000-0x000002D4E9B07000-memory.dmp
memory/5768-44-0x0000000140000000-0x0000000140142000-memory.dmp