Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
30/07/2024, 01:28
General
- Target 6d024b9363b39a0acd1de39d9e8e25dc_JaffaCakes118.dll
- Size 1.2MB
- Sample240730-bv5gla1cll
- SHA256 484d7dea43a0c0e76df55b04cb19202f7fb13e23ed41cbd7746cabcd90a1c5c2
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6d024b9363b39a0acd1de39d9e8e25dc_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\LOYSbakyZ\usocoreworker.exeC:\Users\Admin\AppData\Local\LOYSbakyZ\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\Ax3k\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\Ax3k\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\vQshI1K77\msra.exeC:\Users\Admin\AppData\Local\vQshI1K77\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
CameraSettingsUIHost.exe
DUI70.dll
XmlLite.dll
usocoreworker.exe
UxTheme.dll
msra.exe
Txrhelfambrw.lnk
memory/1424-0-0x00007FFF77790000-0x00007FFF778C1000-memory.dmp
memory/1424-39-0x00007FFF77790000-0x00007FFF778C1000-memory.dmp
memory/1424-3-0x00000254D7130000-0x00000254D7137000-memory.dmp
memory/1832-80-0x0000020EF7DD0000-0x0000020EF7DD7000-memory.dmp
memory/1832-86-0x00007FFF690D0000-0x00007FFF69202000-memory.dmp
memory/2000-52-0x00007FFF690D0000-0x00007FFF69202000-memory.dmp
memory/2000-46-0x00007FFF690D0000-0x00007FFF69202000-memory.dmp
memory/2000-49-0x000001CF79270000-0x000001CF79277000-memory.dmp
memory/2856-66-0x00000226373B0000-0x00000226373B7000-memory.dmp
memory/2856-63-0x00007FFF69090000-0x00007FFF69207000-memory.dmp
memory/2856-69-0x00007FFF69090000-0x00007FFF69207000-memory.dmp
memory/3424-29-0x0000000007680000-0x0000000007687000-memory.dmp
memory/3424-7-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-8-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-9-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-10-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-11-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-12-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-13-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-15-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-17-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-28-0x00007FFF84E8A000-0x00007FFF84E8B000-memory.dmp
memory/3424-30-0x00007FFF869F0000-0x00007FFF86A00000-memory.dmp
memory/3424-36-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-24-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-14-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-6-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3424-4-0x00000000076A0000-0x00000000076A1000-memory.dmp