Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
29/07/2024, 12:20
General
- Target 4645d7422bde4e559b3baf45d0edc8ad_JaffaCakes118.dll
- Size 1.2MB
- Sample240729-ph3n5asdle
- SHA256 f5a9637a6137e8e31c7ba0219242d1990bf723a2441780a237a092f2868f262f
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4645d7422bde4e559b3baf45d0edc8ad_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\N6QLIF\SndVol.exeC:\Users\Admin\AppData\Local\N6QLIF\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\lPXRN9cH7\lpksetup.exeC:\Users\Admin\AppData\Local\lPXRN9cH7\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Taskmgr.exeC:\Windows\system32\Taskmgr.exe1⤵
-
C:\Users\Admin\AppData\Local\l0r1jlg\Taskmgr.exeC:\Users\Admin\AppData\Local\l0r1jlg\Taskmgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SndVol.exe
UxTheme.dll
Taskmgr.exe
dxgi.dll
dpx.dll
lpksetup.exe
Zkmqfrdydbun.lnk
memory/1120-1-0x00007FFBFBE80000-0x00007FFBFBFB0000-memory.dmp
memory/1120-35-0x00007FFBFBE80000-0x00007FFBFBFB0000-memory.dmp
memory/1120-0-0x000002734B900000-0x000002734B907000-memory.dmp
memory/1336-68-0x00007FFBEC290000-0x00007FFBEC3C1000-memory.dmp
memory/1336-64-0x000001EA03410000-0x000001EA03417000-memory.dmp
memory/2976-80-0x00007FFBEC0E0000-0x00007FFBEC211000-memory.dmp
memory/2976-85-0x00007FFBEC0E0000-0x00007FFBEC211000-memory.dmp
memory/3084-46-0x00007FFBEC290000-0x00007FFBEC3C1000-memory.dmp
memory/3084-45-0x00000200A32A0000-0x00000200A32A7000-memory.dmp
memory/3084-51-0x00007FFBEC290000-0x00007FFBEC3C1000-memory.dmp
memory/3596-10-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-36-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-12-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-13-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-14-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-6-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-7-0x00007FFC0956A000-0x00007FFC0956B000-memory.dmp
memory/3596-8-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-23-0x00000000008E0000-0x00000000008E7000-memory.dmp
memory/3596-9-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-15-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-17-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-33-0x00007FFC0AD50000-0x00007FFC0AD60000-memory.dmp
memory/3596-25-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-11-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3596-4-0x0000000002230000-0x0000000002231000-memory.dmp