Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 00:03
General
-
Target
e5ce7011f68ebaaeb173f310c34f87d2_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e5ce7011f68ebaaeb173f310c34f87d2
-
SHA1
b64a4c56ef7f6a6576a0b0f75e3e271a28722d16
-
SHA256
5201a4cd5b69c5e49689be7361c07bceaa2cb9bf8be47e15e44acd582f814359
-
SHA512
4068e1a6ce54d215266a717be3760a21000776f4b9e3f595d5720230d68d8609f5c54e43af922200671353c8d3401433a0b9d80b6a2a475efd5f3ed326d4073d
-
SSDEEP
24576:SVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:SV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5ce7011f68ebaaeb173f310c34f87d2_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\IZjcGUh3\DWWIN.EXEC:\Users\Admin\AppData\Local\IZjcGUh3\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\cT3t\rdpinit.exeC:\Users\Admin\AppData\Local\cT3t\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\mscy3T\CustomShellHost.exeC:\Users\Admin\AppData\Local\mscy3T\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
1.2MB
MD5127a07c3d3a13fd9dbfe630e16f9ae0b
SHA181b457d90e2d511461716f06389777eddef03616
SHA256cf2bf3d79325c7f1ce4ccdedc6a9b3e1432d0d543db52ade8737c36ff768fbf0
SHA512d09c36b667e35e03caa1a9118f7aed16bad3b8bf967a435dfc31044fee93f3b86c9c16ab3c35dd23fbfe6faede25321395f1c5bd064c177f2ab394186ce77aa3
-
Filesize
1.2MB
MD5d2dbe36b5b35aa98ecf4d4ed61cc7e22
SHA176ccd2857039e615b4575ffd86ff50024e06fbc6
SHA256e09a0eaccd188e472d5d3d082c5dfd9960bcfe4a47cf7664177196d8025f7523
SHA5121e9eeb7fce94ad0196ca573f4a6ae8f2b762c5fccf16941840ac5a6aa9bfb3fb17a2dd7f95435114441740770aec59aeed1dad3fd87ef02141fbd9cd2d55c25d
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
835KB
MD570400e78b71bc8efdd063570428ae531
SHA1cd86ecd008914fdd0389ac2dc00fe92d87746096
SHA25691333f3282a2420359ae9d3adf537688741d21e964f021e2b152ab293447f289
SHA51253005dda237fb23af79f54779c74a09835ad4cad3ca7b9dcec80e3793a60dd262f45b910bef96ab9c8e69d0c6990fea6ca5fee85d7f8425db523ae658372959e
-
Filesize
1.2MB
MD53f7f7375fcea7443dc4f72978e041f3f
SHA1df906e13a895bb118b8a3ad46c84802d66d1078e
SHA256c50d071888dba04a58e388bd83995c3a0374b16cab585aa6ea463938072c84ff
SHA512597c8de960f56c4dc82bc24c86d60e2475d063a207d784d5215b809fbd78f581460838922fb08cafca56ec1a26b56fe32c2ad0d4d9a40b3f4d0f2b86341eb751
-
Filesize
1KB
MD53222f28eca50d6809190355685fb5705
SHA12ff08a2029f9b9b55a68ce3e34751a018b9d544b
SHA256e9f81481f4f835bc112bcfd4bc0675475a288dfb9c75a7c8fef9423446dbe2e9
SHA512da2706215761d6912aa18a5003620aaf450f0d639e34d2e8a26516c48544ac85afe9e64276622425d948e3bebd4c2585e44086324cf7c345e6ac42bf3cfb8234
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB