Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
- submitted
02/08/2024, 02:20
General
- Target 82ad4f64c89c3bbbd8cd8e53607071ea_JaffaCakes118.dll
- Size 1.2MB
- Sample240802-csp5kavdrf
- SHA256 a594d78a5f1c9a6ca8d3b108513c84fcf4d12819dee46890074d5b0688120ac1
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\82ad4f64c89c3bbbd8cd8e53607071ea_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinput.exeC:\Windows\system32\rdpinput.exe1⤵
-
C:\Users\Admin\AppData\Local\jUZQ8E2\rdpinput.exeC:\Users\Admin\AppData\Local\jUZQ8E2\rdpinput.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\FBLN39GJ\wlrmdr.exeC:\Users\Admin\AppData\Local\FBLN39GJ\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Users\Admin\AppData\Local\h7RH0Gwo\recdisc.exeC:\Users\Admin\AppData\Local\h7RH0Gwo\recdisc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DUI70.dll
wlrmdr.exe
ReAgent.dll
recdisc.exe
WTSAPI32.dll
rdpinput.exe
Ojzvdc.lnk
memory/212-1-0x00007FFC65D90000-0x00007FFC65EC1000-memory.dmp
memory/212-39-0x00007FFC65D90000-0x00007FFC65EC1000-memory.dmp
memory/212-3-0x0000016F4FEE0000-0x0000016F4FEE7000-memory.dmp
memory/1044-52-0x00007FFC65D90000-0x00007FFC65EC2000-memory.dmp
memory/1044-46-0x00007FFC65D90000-0x00007FFC65EC2000-memory.dmp
memory/1044-49-0x0000020424730000-0x0000020424737000-memory.dmp
memory/1624-64-0x00007FFC657F0000-0x00007FFC65967000-memory.dmp
memory/1624-63-0x00000204C1180000-0x00000204C1187000-memory.dmp
memory/1624-69-0x00007FFC657F0000-0x00007FFC65967000-memory.dmp
memory/1808-83-0x000001F07A710000-0x000001F07A717000-memory.dmp
memory/1808-86-0x00007FFC65D90000-0x00007FFC65EC2000-memory.dmp
memory/3544-37-0x0000000000C00000-0x0000000000C07000-memory.dmp
memory/3544-7-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-8-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-9-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-11-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-13-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-12-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-14-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-16-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-33-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-35-0x00007FFC7378A000-0x00007FFC7378B000-memory.dmp
memory/3544-38-0x00007FFC743F0000-0x00007FFC74400000-memory.dmp
memory/3544-24-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-15-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-6-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-10-0x0000000140000000-0x0000000140131000-memory.dmp
memory/3544-4-0x0000000000F30000-0x0000000000F31000-memory.dmp