Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2024 09:40
Static task
static1
Behavioral task
behavioral1
Sample
be536247ecfde74a90f9f41ed376736d_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
be536247ecfde74a90f9f41ed376736d_JaffaCakes118.dll
-
Size
784KB
-
MD5
be536247ecfde74a90f9f41ed376736d
-
SHA1
e3c0195fcbce731754ad07f1180a80779d9a0b35
-
SHA256
ff3a35ebb7a529054539464c438c1ac920647e55dac7e8f853cf33c2bfc6da7b
-
SHA512
e753ddd34acc8628a81f4b855b2828f8f235166ca211597727220085ad0889f8df60774e2fad295c86228f5207b862d72eec1ee0b2f6f2a3e0ec5c45894de68c
-
SSDEEP
12288:KH2Ijy7t9KVRxsYFPRSo5XkBCLu+PY1iqTrGaFhnt/vqqBhf54MOFNkSr:KH2Cgt9eDpSxP1iqTzVSqBv5OFx
Malware Config
Extracted
dridex
10444
209.20.87.138:443
198.1.115.153:8172
151.236.29.248:6516
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 30 1236 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4064 wrote to memory of 1236 4064 rundll32.exe 86 PID 4064 wrote to memory of 1236 4064 rundll32.exe 86 PID 4064 wrote to memory of 1236 4064 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be536247ecfde74a90f9f41ed376736d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be536247ecfde74a90f9f41ed376736d_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:1236
-