Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
29/07/2024, 06:41
General
- Target 3b2c7075ab9446ded1ef47ed89a81c35_JaffaCakes118.dll
- Size 1.2MB
- Sample240729-hf5bls1eph
- SHA256 2629cf699f2cf1b89996221446aae59b3f5e57b4d08cb28486beaadaf24c070a
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2c7075ab9446ded1ef47ed89a81c35_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\2Rgluoh\raserver.exeC:\Users\Admin\AppData\Local\2Rgluoh\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\GI1PYU1\BdeUISrv.exeC:\Users\Admin\AppData\Local\GI1PYU1\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\HcbI\psr.exeC:\Users\Admin\AppData\Local\HcbI\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WTSAPI32.dll
raserver.exe
BdeUISrv.exe
WTSAPI32.dll
VERSION.dll
psr.exe
Reuom.lnk
memory/516-52-0x00007FF882730000-0x00007FF882862000-memory.dmp
memory/516-46-0x00007FF882730000-0x00007FF882862000-memory.dmp
memory/516-49-0x0000025F965E0000-0x0000025F965E7000-memory.dmp
memory/2924-69-0x00007FF882730000-0x00007FF882862000-memory.dmp
memory/2924-66-0x0000011873C90000-0x0000011873C97000-memory.dmp
memory/3464-38-0x00007FF8A00B0000-0x00007FF8A00C0000-memory.dmp
memory/3464-37-0x0000000001330000-0x0000000001337000-memory.dmp
memory/3464-13-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-12-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-10-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-9-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-8-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-6-0x00007FF89FFAA000-0x00007FF89FFAB000-memory.dmp
memory/3464-16-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-17-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-34-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-14-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-4-0x00000000031B0000-0x00000000031B1000-memory.dmp
memory/3464-25-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-15-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-7-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3464-11-0x0000000140000000-0x0000000140131000-memory.dmp
memory/4464-81-0x000001B0CD730000-0x000001B0CD737000-memory.dmp
memory/4464-86-0x00007FF882730000-0x00007FF882862000-memory.dmp
memory/4616-3-0x00000130D3200000-0x00000130D3207000-memory.dmp
memory/4616-39-0x00007FF891630000-0x00007FF891761000-memory.dmp
memory/4616-1-0x00007FF891630000-0x00007FF891761000-memory.dmp