Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-07-2024 00:15

General

  • Target

    2d49503d2bb2c8767fb1694130330e24_JaffaCakes118.dll

  • Size

    1.2MB

  • MD5

    2d49503d2bb2c8767fb1694130330e24

  • SHA1

    b083e2e518dce9faf0c317b4080edac716f8a7d6

  • SHA256

    0f7f2948cdd5729afb075981ca2d0fac509ac37886e1d0faec72fc52d12f7571

  • SHA512

    f120f2949aa084e8c363880e3030bab186c2fc8504bb1813bc5e49fafa043d213cccb0b57454a7dd4d513c73eb3af5dd251f028c6327cb3e8a87bdff1953a309

  • SSDEEP

    24576:9uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:X9cKrUqZWLAcU

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d49503d2bb2c8767fb1694130330e24_JaffaCakes118.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3920
  • C:\Windows\system32\rdpclip.exe
    C:\Windows\system32\rdpclip.exe
    1⤵
      PID:2668
    • C:\Users\Admin\AppData\Local\SsU4jxofg\rdpclip.exe
      C:\Users\Admin\AppData\Local\SsU4jxofg\rdpclip.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:232
    • C:\Windows\system32\SystemSettingsAdminFlows.exe
      C:\Windows\system32\SystemSettingsAdminFlows.exe
      1⤵
        PID:2092
      • C:\Users\Admin\AppData\Local\EpGF6kO\SystemSettingsAdminFlows.exe
        C:\Users\Admin\AppData\Local\EpGF6kO\SystemSettingsAdminFlows.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1192
      • C:\Windows\system32\phoneactivate.exe
        C:\Windows\system32\phoneactivate.exe
        1⤵
          PID:540
        • C:\Users\Admin\AppData\Local\SnW1Lh\phoneactivate.exe
          C:\Users\Admin\AppData\Local\SnW1Lh\phoneactivate.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:4780

        Network

        • flag-us
          DNS
          71.159.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          71.159.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          30.243.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          30.243.111.52.in-addr.arpa
          IN PTR
          Response
        No results found
        • 8.8.8.8:53
          71.159.190.20.in-addr.arpa
          dns
          72 B
          158 B
          1
          1

          DNS Request

          71.159.190.20.in-addr.arpa

        • 8.8.8.8:53
          30.243.111.52.in-addr.arpa
          dns
          72 B
          158 B
          1
          1

          DNS Request

          30.243.111.52.in-addr.arpa

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\EpGF6kO\SystemSettingsAdminFlows.exe

          Filesize

          506KB

          MD5

          50adb2c7c145c729b9de8b7cf967dd24

          SHA1

          a31757f08da6f95156777c1132b6d5f1db3d8f30

          SHA256

          a7a2e7122d27308df37b7ab718ef3ac239e4216669f51331e34e205f59fb0aec

          SHA512

          715b4c93e79e896da1cf86cf4455a84cba1aeac34b6fd72d2afdf203a2034f6f8fac1d6501f0dd277a17bd1d7ab73ddd1887e01a99f2d26f39efeb94d0aac9b0

        • C:\Users\Admin\AppData\Local\EpGF6kO\newdev.dll

          Filesize

          1.2MB

          MD5

          ba883d01bcf9bf41cd295ecf297d9eb6

          SHA1

          718cde1b6be8ab4853e1854061caa193bfe8c8d2

          SHA256

          92ce1dd62e28c6793f28802df956876dbf48d8efd976ba601ad9dbf983d95e03

          SHA512

          7e2331c36d87f53492d0db4055b23f05eee290775724c73deaedcf8fef2d4f50d3ffdd3047f633007d41c3e3fff684f3ad44725edeba864f11186fe1fbcd855f

        • C:\Users\Admin\AppData\Local\SnW1Lh\DUI70.dll

          Filesize

          1.4MB

          MD5

          78c6ee9758fca24d644aadf14ce2b066

          SHA1

          f8887a709f365f5189a9edd28c341852ba3de639

          SHA256

          dde7deb3373610ad3d3aab7323236f209a1f04db3c3b456bce5727ad9df063ef

          SHA512

          c14b8df5e69c2b8fe16c70c74836accecb101ebb8ec72f48629949a2d52527f109eb0ed798046494adf213b4d8463f359ba2a8beccb8761e2dc41862ec570789

        • C:\Users\Admin\AppData\Local\SnW1Lh\phoneactivate.exe

          Filesize

          107KB

          MD5

          32c31f06e0b68f349f68afdd08e45f3d

          SHA1

          e4b642f887e2c1d76b6b4777ade91e3cb3b9e27c

          SHA256

          cea83eb34233fed5ebeef8745c7c581a8adbefbcfc0e30e2d30a81000c821017

          SHA512

          fe61764b471465b164c9c2202ed349605117d57ceb0eca75acf8bda44e8744c115767ee0caed0b7feb70ba37b477d00805b3fdf0d0fa879dd4c8e3c1dc1c0d26

        • C:\Users\Admin\AppData\Local\SsU4jxofg\WINSTA.dll

          Filesize

          1.2MB

          MD5

          7ce330bb546ae4bea62aa91f3ac5f000

          SHA1

          ab8cb492afba2a55e36e4c3da68b20201fa57b55

          SHA256

          b327b1918b25373d9608e353f62368547dd106d0385b3c7858f966175c9d3814

          SHA512

          0312986cc0c7431aff91d304b5a5ee6e6ccf9054c633f24d1568bd19792292d51fe683a08094b2a9be7aacfde926009834c87c961a2ce9623930251fb7dc2ed5

        • C:\Users\Admin\AppData\Local\SsU4jxofg\rdpclip.exe

          Filesize

          446KB

          MD5

          a52402d6bd4e20a519a2eeec53332752

          SHA1

          129f2b6409395ef877b9ca39dd819a2703946a73

          SHA256

          9d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308

          SHA512

          632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Rnqxvswjyjuqjvh.lnk

          Filesize

          1KB

          MD5

          2698d5c66a31f833a779e02f2e998043

          SHA1

          59802c4dc56a77d73f07c7207981443a149b3d55

          SHA256

          851c77c6ae1f5f4bf05e71968bdd4e7957cdef29f9d4718149573b4a6ed1df32

          SHA512

          94602e89489163375a44b51b6ba91ec340497f1be8a89904a969f5794e5db5f7cd3712804a61b3013fd137b9fb24dc6ef5cb8a5d11b7e4c2ebf438d6f32b4a3a

        • memory/232-52-0x00007FFB0A9C0000-0x00007FFB0AAF3000-memory.dmp

          Filesize

          1.2MB

        • memory/232-48-0x00007FFB0A9C0000-0x00007FFB0AAF3000-memory.dmp

          Filesize

          1.2MB

        • memory/232-46-0x00000266A13D0000-0x00000266A13D7000-memory.dmp

          Filesize

          28KB

        • memory/1192-63-0x00007FFB0A9C0000-0x00007FFB0AAF2000-memory.dmp

          Filesize

          1.2MB

        • memory/1192-66-0x000001F3C1220000-0x000001F3C1227000-memory.dmp

          Filesize

          28KB

        • memory/1192-69-0x00007FFB0A9C0000-0x00007FFB0AAF2000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-34-0x0000000001080000-0x0000000001087000-memory.dmp

          Filesize

          28KB

        • memory/3396-13-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-9-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-8-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-24-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-7-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-4-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

          Filesize

          4KB

        • memory/3396-11-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-12-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-14-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-15-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-33-0x00007FFB17F5A000-0x00007FFB17F5B000-memory.dmp

          Filesize

          4KB

        • memory/3396-6-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-36-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-35-0x00007FFB19CF0000-0x00007FFB19D00000-memory.dmp

          Filesize

          64KB

        • memory/3396-16-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3396-10-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/3920-1-0x00007FFB0A9C0000-0x00007FFB0AAF1000-memory.dmp

          Filesize

          1.2MB

        • memory/3920-39-0x00007FFB0A9C0000-0x00007FFB0AAF1000-memory.dmp

          Filesize

          1.2MB

        • memory/3920-3-0x0000000002AE0000-0x0000000002AE7000-memory.dmp

          Filesize

          28KB

        • memory/4780-80-0x00007FFB0A980000-0x00007FFB0AAF7000-memory.dmp

          Filesize

          1.5MB

        • memory/4780-85-0x00007FFB0A980000-0x00007FFB0AAF7000-memory.dmp

          Filesize

          1.5MB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.