Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-08-2024 03:54
General
-
Target
9cdb43c23cbe72a36e8ace440955fbb8_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
9cdb43c23cbe72a36e8ace440955fbb8
-
SHA1
738d4cbc3da26c3dce6efe3f42d960cb6d504ac6
-
SHA256
580717185d7152b8d9b743535f769b840dc8387ed3fc4cf61d411a6733afef1d
-
SHA512
6ff44db456afbc663d751af9984f037dcdf2fb8b70de6141748904508e0f730375b1f6b7903031c617336048187c955efe48a6082f31edfedea6583baf5d430f
-
SSDEEP
24576:2uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:29cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9cdb43c23cbe72a36e8ace440955fbb8_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\NgV7u\bdechangepin.exeC:\Users\Admin\AppData\Local\NgV7u\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\raFW\perfmon.exeC:\Users\Admin\AppData\Local\raFW\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\dTsG\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\dTsG\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5ca44f3bd5ba2ffe1e6d3e5e42da30f78
SHA137d8dd9644857fedbb812bd8eb549195961ee1ae
SHA2561702864311bb6200eb87884e294cb29156a8267cc5de9b97dd6a00d26dd8ddff
SHA51258c694966827598cb21ee9331e4f18d935ba058d33ba4abcf9524b62aa8e956b75d4a24740b52f1e197b3ef01d4862d6c0b28e019a5ab67ab495dce768b658e2
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.4MB
MD50464aca6fc7b108fd5ff5232e508fda0
SHA1216b2b7b8c47f7770b07198c61d28959df1ae15b
SHA2563f88ce73e7a29d0edc6a6bec98605e7cf98a866f98d2ea6b6d28e6c36e6ad805
SHA512e247ce2761c48d60a1815c5ffd631b579bd1799fbe11c8a49329e265310e69ce5749b3f5881b5fc8f60b334ab8f50cdde599680ff83607a4d55b5aff5c6671fc
-
Filesize
1.2MB
MD55bc8a8c8b3cbc5729df67c22f314b3b2
SHA1c999e024858876725411d99611ebc8141fef03b8
SHA25656d3d4e45cbc17d7716d8add638b42ca312057605e4927b22f6382f26b4eacd6
SHA5129d7130a1c2660b4fe17d40a3971f2d5f10b224f480463237b9f91616b7f84a108f6c4d286e55a6e0014be459959cbf177a62edc5a9f70e23448d0a0924cf46c4
-
Filesize
177KB
MD5d38aa59c3bea5456bd6f95c73ad3c964
SHA140170eab389a6ba35e949f9c92962646a302d9ef
SHA2565f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c
SHA51259fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68
-
Filesize
1KB
MD5b227216dc3956b5dd8d2566bac393359
SHA1331ffd2f453dfaae9bb3d2d5e5f72b9a2c355670
SHA2560c73ae77b3ce96804517686e78bcd32118709da7a1f40b97486fe23939dd606e
SHA512651a49357e36b3407dde7f1fbffdc06d21da2a141d94cc69dbf148b03a2e85144390b4c5283cc5073f2635e810eade710a1ca5fa78dcd57a53e6505652b1c2f5
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB