Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
29-07-2024 02:45
General
-
Target
3419fa482b6568b8f57a109c37efbb6a_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
3419fa482b6568b8f57a109c37efbb6a
-
SHA1
b7e9b700a063409acebaf68978058ccd1483a3b4
-
SHA256
de941aa21b4dc90656dc241719d3ce01cf582dc24404c2abec1c390b6214186c
-
SHA512
7d0fba934c86b69c988bf8ab8126099ec67d55d61135d96181695fa0d8d40fd048b587660fb45b1f6fe90819299b5e0a48d943f921eacdfa12637b2c44774c7c
-
SSDEEP
24576:RuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:D9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3419fa482b6568b8f57a109c37efbb6a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\71X\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\71X\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\xQE\wbengine.exeC:\Users\Admin\AppData\Local\xQE\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\s5J9mJ\dialer.exeC:\Users\Admin\AppData\Local\s5J9mJ\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD563b10d8790480f55f2226b5b3d63bf2c
SHA1aaa43ee96ad4faec2267d2f1193b7b5d7b793c91
SHA256237bfeb2544b6377e5f598e1e56df795e45594e7ecf467d5df12358bfbc6caf3
SHA5122abdb46c168ae2d3a1f8efdfa71d29af1e987f4b114fc235c45f2bd50b2d65c3a0959ab2a368540f5fd4a4d6d9cdfdd44dba26d556ca5b66df7f295852612046
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
1.2MB
MD5ab9b5129126352678ce19fe003f217cc
SHA1ac6057a5b5b9b3009879621a7745b71b6df09eb1
SHA256aa19e0ee6675398595baa9cb52e91f21e15a3f8c992648f1aacd35e688e874fc
SHA5120751b92b473533a14de34bd8a7233779bfd16482cb98fd6c8f370b5e68efda30e780e4c906acc3772be0e8b9c76e50cfe674f3bc0ef483db885b04e5df2f1849
-
Filesize
39KB
MD5b2626bdcf079c6516fc016ac5646df93
SHA1838268205bd97d62a31094d53643c356ea7848a6
SHA256e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb
SHA512615cfe1f91b895513c687906bf3439ca352afcadd3b73f950af0a3b5fb1b358168a7a25a6796407b212fde5f803dd880bcdc350d8bac7e7594090d37ce259971
-
Filesize
1.5MB
MD517270a354a66590953c4aac1cf54e507
SHA1715babcc8e46b02ac498f4f06df7937904d9798d
SHA2569954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4
SHA5126be0ba6be84d01ab47f5a4ca98a6b940c43bd2d1e1a273d41c3e88aca47da11d932024b007716d1a6ffe6cee396b0e3e6971ab2afc293e72472f2e61c17b2a89
-
Filesize
1.2MB
MD577b01fd98fed32181d77d9e23452adf0
SHA108baf7b84a5dde901cf94bd180f15ff4e0ecc36a
SHA2560d7065387e00362afd8f71931b322adb63a593770b87f4eee8199301e128103f
SHA512193ca3bd58db4f394aea8852249f254cb0242e2dbc494074a86e47510425bcda2425687160d535adab8bc2625dda741ce9f076bda1b66743ebb57d9e33bacd36
-
Filesize
1KB
MD536c58fdddd892925adf3d9fd10ee9e08
SHA1a881e3952fb3938b85eb30b98c73edcf0b688d14
SHA25675361420963ba7eca3d7c7555ddd520974e9765dcafdb84bbbd00413be56cb82
SHA5122750613e691ca425a5b09132214b634b7a8adafd631ed996dccc3229271713e6f8eb44bbedc8d1634d38f00a7e5917d514f4ec6037261c479a91537241441a5f
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
60KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB