Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240729-en -
resource tags
-
submitted
30-07-2024 14:01
General
-
Target
72fb9a4545e473d7d94fe766e6654729_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
72fb9a4545e473d7d94fe766e6654729
-
SHA1
eaffdc1dc71421e6f523456e2ecf7fd0ae60b2f2
-
SHA256
9098e782f34228349487ef9250a37c00874cb70ef152d48ac89125ad23c899fc
-
SHA512
740ab9c74701d3c280354c596e458fa05e795527c9bf522f87949abf13602db822e485f639c89d0a9996bfcb5782aa30040afcd75a9ac51c64ad2b2c349802c9
-
SSDEEP
24576:juYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:N9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72fb9a4545e473d7d94fe766e6654729_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\jBL\wlrmdr.exeC:\Users\Admin\AppData\Local\jBL\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\EiNqRsW\cmstp.exeC:\Users\Admin\AppData\Local\EiNqRsW\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\e704j1c4\unregmp2.exeC:\Users\Admin\AppData\Local\e704j1c4\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5ebea95355453b0302f9661280e106a7e
SHA17ac502d5e42d050d994cecc0a8b3bdbf2fcebf24
SHA2568317abbdbd1321f804cdb630606a6c9d154b36101a062d1afaa2a998034ec63b
SHA5120ce294fd4c367811a00367fb2eaee67c6cec23492ba28821e40d450e8ae99d8bb93358e67f94d80605c829eb8af057d5f6009b5e3622cb5493372cad725d079e
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
1.2MB
MD536c9894d3782d8bada7ab64322897155
SHA1babf35126e5073c81dbf65aa9ca7496040cd328d
SHA256d50f1e809db0dd87f0fa7ebb9c9ef6c8ec08d53dac58c031b10dab52b0b92b93
SHA51287971e759e1dfa2c26b21e10368c72dec07369157792b96feaa97c57349fb13462b5f5503cff0f74bbaff598bcd947046d5f9605537ab94690d00977b6de6c22
-
Filesize
259KB
MD5a6fc8ce566dec7c5873cb9d02d7b874e
SHA1a30040967f75df85a1e3927bdce159b102011a61
SHA25621f41fea24dddc8a32f902af7b0387a53a745013429d8fd3f5fa6916eadc839d
SHA512f83e17dd305eb1bc24cca1f197e2440f9b501eafb9c9d44ede7c88b1520030a87d059bdcb8eadeac1eaedabcbc4fe50206821965d73f0f6671e27edd55c01cbc
-
Filesize
1.4MB
MD5e32471d4b4e5b74ed176f30fd2916d7f
SHA18fdacdc47841b73e53047534b7b8e2117090cd37
SHA256fc8c25316cbbc9789f74ea3b864c647f4fcb374861fe6ab0d566edc0465d6c93
SHA5128ea92f0dbd1771b17cf86a01e604ca365578dad008892a434c1c8f9258e0e623b8fb7007bbb333eb4b98817f7c8b1584dd2abc58025b9f3fe1d10818be2a0d07
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
1KB
MD5f7e574394676108d293018758a4af8c1
SHA1dadb768f2b94e5f1e3ed2a8340b095d4f123fb35
SHA256c10314d52e58b689c78a007848ef1fb24c7590aaf9d639eb558f87748328ad1a
SHA51233a5bd05dc68a6785b8857d607dbd4ede492e01ba02976fce0b4e5508b6154d40b9f123c32995ea0aa477ec07b8bdf75ba93a7c1fe261469e3ef6a6d100796fa
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB