Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/08/2024, 12:22
General
- Target b79de8bd575fd4c340b9fa4352696533_JaffaCakes118.dll
- Size 1.2MB
- Sample240822-pj8a1awgpb
- SHA256 5f809c22a4793c5f79ce37d5621580998d890837537e420d638ef1681964220d
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b79de8bd575fd4c340b9fa4352696533_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\CUyNSRND\rdpshell.exeC:\Users\Admin\AppData\Local\CUyNSRND\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\tY2WGyM2s\mmc.exeC:\Users\Admin\AppData\Local\tY2WGyM2s\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\2s6\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\2s6\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\YoTWRgkj\SppExtComObj.ExeC:\Users\Admin\AppData\Local\YoTWRgkj\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SYSDM.CPL
SystemPropertiesRemote.exe
dwmapi.dll
rdpshell.exe
ACTIVEDS.dll
SppExtComObj.Exe
MFC42u.dll
mmc.exe
Mcinmsnhewplgza.lnk
memory/1880-80-0x00007FFF2AE30000-0x00007FFF2AF61000-memory.dmp
memory/1880-77-0x0000025FF5AD0000-0x0000025FF5AD7000-memory.dmp
memory/1884-0-0x0000024A15390000-0x0000024A15397000-memory.dmp
memory/1884-38-0x00007FFF3AF90000-0x00007FFF3B0C0000-memory.dmp
memory/1884-1-0x00007FFF3AF90000-0x00007FFF3B0C0000-memory.dmp
memory/3300-96-0x00007FFF2AE30000-0x00007FFF2AF61000-memory.dmp
memory/3524-16-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-4-0x0000000002920000-0x0000000002921000-memory.dmp
memory/3524-7-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-9-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-24-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-10-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-8-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-35-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-5-0x00007FFF4941A000-0x00007FFF4941B000-memory.dmp
memory/3524-12-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-13-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-11-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-14-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-29-0x00007FFF495D0000-0x00007FFF495E0000-memory.dmp
memory/3524-15-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3524-28-0x0000000000740000-0x0000000000747000-memory.dmp
memory/4120-45-0x0000029A34B10000-0x0000029A34B17000-memory.dmp
memory/4120-51-0x00007FFF2AE30000-0x00007FFF2AF61000-memory.dmp
memory/4120-46-0x00007FFF2AE30000-0x00007FFF2AF61000-memory.dmp
memory/4944-67-0x00007FFF2ADD0000-0x00007FFF2AF07000-memory.dmp
memory/4944-64-0x00007FFF2ADD0000-0x00007FFF2AF07000-memory.dmp
memory/4944-63-0x0000000002380000-0x0000000002387000-memory.dmp