Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13-08-2024 19:31

General

  • Target

    946f198f08b87a5905b23ba3874d29f8_JaffaCakes118.dll

  • Size

    1.2MB

  • MD5

    946f198f08b87a5905b23ba3874d29f8

  • SHA1

    415cd2e62beb581b477c633373aee2f0ab850035

  • SHA256

    abdd071d272c602d9eb594c38b82fab881b995e75614c0956470c44f7e1654a6

  • SHA512

    7806161254fb434014babf4794ff8bf8b1f4f2727a2fabd59d84b951fdbd28787bcf6a888f55620fb78161c5094eb99e5925884e8db473c08ccf96dfa944634b

  • SSDEEP

    24576:AuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:Q9cKrUqZWLAcU

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\946f198f08b87a5905b23ba3874d29f8_JaffaCakes118.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2364
  • C:\Windows\system32\perfmon.exe
    C:\Windows\system32\perfmon.exe
    1⤵
      PID:2732
    • C:\Users\Admin\AppData\Local\UfP\perfmon.exe
      C:\Users\Admin\AppData\Local\UfP\perfmon.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2948
    • C:\Windows\system32\rdrleakdiag.exe
      C:\Windows\system32\rdrleakdiag.exe
      1⤵
        PID:2888
      • C:\Users\Admin\AppData\Local\MHmw\rdrleakdiag.exe
        C:\Users\Admin\AppData\Local\MHmw\rdrleakdiag.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2288
      • C:\Windows\system32\recdisc.exe
        C:\Windows\system32\recdisc.exe
        1⤵
          PID:1116
        • C:\Users\Admin\AppData\Local\O8zBcm\recdisc.exe
          C:\Users\Admin\AppData\Local\O8zBcm\recdisc.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1708

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\MHmw\VERSION.dll

          Filesize

          1.2MB

          MD5

          7b95c97ac5a36cccd8d226821a36987d

          SHA1

          0c1b5c94999aa06eae1627471be353d617eec8e9

          SHA256

          c53ff9e18910407e891edaffb5e027a59abc1a7ee3693864ad5ff003898a08e8

          SHA512

          9b0b111b354403695bc816bcebfae2db5e2272a9b9e75f27fe314a8993317772129a2bc47bb0a25890f38b77c1b77b647a4826324bf288e52d8a604bea4e611d

        • C:\Users\Admin\AppData\Local\MHmw\rdrleakdiag.exe

          Filesize

          39KB

          MD5

          5e058566af53848541fa23fba4bb5b81

          SHA1

          769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6

          SHA256

          ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409

          SHA512

          352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0

        • C:\Users\Admin\AppData\Local\O8zBcm\ReAgent.dll

          Filesize

          1.2MB

          MD5

          8a86edef70bec0aa702eec0f9f214e7e

          SHA1

          c5c7b793a71601534e77b1a95bb6d96082ea7935

          SHA256

          f19f5a7abe8ac2cbade5ae98211b7cad86fca430318969f81c52fc9de0f56852

          SHA512

          a68bd3741a6324461ebf44b52b2b9cbd0b2cf0e14a7fb6333f306281a647a1661a39d15cdf9c5271359211867d4adb445d4fb59e1817847ee7383158a9104ede

        • C:\Users\Admin\AppData\Local\UfP\Secur32.dll

          Filesize

          1.2MB

          MD5

          ebac51de94bcdbaad7aa66441a5ec73b

          SHA1

          d2143d3d9341e59dd220554e16e6dce03e90943d

          SHA256

          87c6fb394c36684ba0ee6163d84eaf426e712c7d8db27a7e61ccb33b5a3feb09

          SHA512

          6d5d2e559580e440ca00e8686694dba5254d203797bd740ad9a2e3227ae38fd0128d66acad04b34a3973e173dc1cc2f0aa0a384ab4a641271cf3e57af7fae599

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Rinzzkcfiw.lnk

          Filesize

          1KB

          MD5

          82a984d8cde4d243d917f1d493fb19e1

          SHA1

          dc93220867825b1f3fa6f6b55d803ad125e3e1a8

          SHA256

          cd2c8b93b9ead00bb440d18543f83a73b857e1116b8a5dbd912f1e8c827143c4

          SHA512

          20fdf840e84e2bc7dfb53752af64f0f05d40020e1635f2da13e20bf56fcb8ec02a5bcacaa736747bf5f9652f88dc376262118431aeb8b100eec67db77ef02a44

        • \Users\Admin\AppData\Local\O8zBcm\recdisc.exe

          Filesize

          232KB

          MD5

          f3b306179f1840c0813dc6771b018358

          SHA1

          dec7ce3c13f7a684cb52ae6007c99cf03afef005

          SHA256

          dcaeb590394b42d180e23e3cef4dd135513395b026e0ed489aec49848b85b8f0

          SHA512

          9f9ec4c2ca6373bd738bf415d059f3536390e46e5b0a560e9ee1b190407a6d0f481c38664c51b834a9e72d8878f71c3c19e427e3a6b5ca4ec6b02d1156eb9ef4

        • \Users\Admin\AppData\Local\UfP\perfmon.exe

          Filesize

          168KB

          MD5

          3eb98cff1c242167df5fdbc6441ce3c5

          SHA1

          730b27a1c92e8df1e60db5a6fc69ea1b24f68a69

          SHA256

          6d8d5a244bb5a23c95653853fec3d04d2bdd2df5cff8cffb9848bddeb6adb081

          SHA512

          f42be2a52d97fd1db2ed5a1a1a81a186a0aab41204980a103df33a4190632ba03f3cbb88fcea8da7ed9a5e15f60732d49a924b025fe6d3e623195ec1d37dfb35

        • memory/1392-28-0x0000000076ED0000-0x0000000076ED2000-memory.dmp

          Filesize

          8KB

        • memory/1392-25-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-16-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-14-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-13-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-12-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-11-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-10-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-9-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-8-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-27-0x0000000076D41000-0x0000000076D42000-memory.dmp

          Filesize

          4KB

        • memory/1392-4-0x0000000076C36000-0x0000000076C37000-memory.dmp

          Filesize

          4KB

        • memory/1392-39-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-37-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-5-0x0000000002A20000-0x0000000002A21000-memory.dmp

          Filesize

          4KB

        • memory/1392-17-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-26-0x0000000002260000-0x0000000002267000-memory.dmp

          Filesize

          28KB

        • memory/1392-7-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-15-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1392-65-0x0000000076C36000-0x0000000076C37000-memory.dmp

          Filesize

          4KB

        • memory/1708-91-0x0000000000080000-0x0000000000087000-memory.dmp

          Filesize

          28KB

        • memory/1708-97-0x000007FEF7120000-0x000007FEF7252000-memory.dmp

          Filesize

          1.2MB

        • memory/2288-73-0x000007FEF7120000-0x000007FEF7252000-memory.dmp

          Filesize

          1.2MB

        • memory/2288-76-0x0000000000170000-0x0000000000177000-memory.dmp

          Filesize

          28KB

        • memory/2288-79-0x000007FEF7120000-0x000007FEF7252000-memory.dmp

          Filesize

          1.2MB

        • memory/2364-46-0x000007FEF7120000-0x000007FEF7251000-memory.dmp

          Filesize

          1.2MB

        • memory/2364-0-0x0000000000120000-0x0000000000127000-memory.dmp

          Filesize

          28KB

        • memory/2364-1-0x000007FEF7120000-0x000007FEF7251000-memory.dmp

          Filesize

          1.2MB

        • memory/2948-60-0x000007FEFA980000-0x000007FEFAAB2000-memory.dmp

          Filesize

          1.2MB

        • memory/2948-55-0x000007FEFA980000-0x000007FEFAAB2000-memory.dmp

          Filesize

          1.2MB

        • memory/2948-54-0x0000000000280000-0x0000000000287000-memory.dmp

          Filesize

          28KB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.