Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18-09-2024 07:38
General
-
Target
e89fed8bcadd8c09505de5a77f5869fd_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e89fed8bcadd8c09505de5a77f5869fd
-
SHA1
73b46bfbcf230c1f0a5bfe6efe53c43b494a8c25
-
SHA256
71e81df6b6a1662f36f6dbd56571d345bf55f342d6deb464c33c2c3cb2c55d4d
-
SHA512
8a0185e05880d5979b392bdb02f15c6f37b7b8dbde337f71f6e41291f05d281b222a9d9df31965f4c2640e299bf0e265da96333b7fc1190e5fb6c0570264dbfc
-
SSDEEP
24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e89fed8bcadd8c09505de5a77f5869fd_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\icardagt.exeC:\Windows\system32\icardagt.exe1⤵
-
C:\Users\Admin\AppData\Local\yuFQrZz\icardagt.exeC:\Users\Admin\AppData\Local\yuFQrZz\icardagt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\v8B\raserver.exeC:\Users\Admin\AppData\Local\v8B\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\HGIj\iexpress.exeC:\Users\Admin\AppData\Local\HGIj\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD59ccad5b3f95b68af9c0f7504b494f27f
SHA11b4e34dee2e02c109278e1b653e30446160b71c0
SHA256581a62806df3332ddffe37931d2346bde9cff799de47fe92c635a1801a31e8f3
SHA512d3c88e79a0c41484d0b8c51bec8a26d2c8dd8531096f70d756232def227c788cd00f0244d9fbc4aff8cbc2ca4231a7b958c9dee7f10e2964e9d25357aa595f60
-
Filesize
1.2MB
MD551b0478497d67e3daf66d0ea9b2a174e
SHA191572054735abbe1736fcf7c0458f433ebba7877
SHA256b4f141f49b8b9ee7864e6fbb43513f9692614d135d81491114d6790448317fe9
SHA512970e0f55fc6cb9a20cac89072c157b5c20129649620c6fc4d2cca2b8c9ca3ef92f5e6a3b0bd509ca28cde0dfa029ea052daf3df4e28823f74b67d58d206eda1b
-
Filesize
1.2MB
MD520103a9e5988e7d34b11d5146348c1ba
SHA1f427f28f779575c73d950e9697e5506139568132
SHA25688521739a1bad9d98edab99731c5f61d494f6bb1e69fd0423b3fcf67f527f8b8
SHA5126314705cf98377a30215d43c1755d05a34780b1b36b0e0331499cbf282fd8c40bf1290453aa083ea944ce63b3b4c934c3b167f89de81b9f81054290fab3f005d
-
Filesize
1005B
MD589eeea336770a88f4350ac647c2bb468
SHA1b2b1a5dfd9892b75f6ffdb4c02558353204cdc6d
SHA2560ab8a6a83728b73af24ad8479bccbc3d549076d9d35d4fbb52635518d8c57a49
SHA51280c832e12039adfed7fbc5ad056717989313d5a3b065bf037d5582a587f595008ad47b1ba12f24f0e3a2eef320f897858ceb17cd8ba1b979e0d11e71f881c9e4
-
Filesize
163KB
MD546fd16f9b1924a2ea8cd5c6716cc654f
SHA199284bc91cf829e9602b4b95811c1d72977700b6
SHA2569f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA51252c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
1.3MB
MD52fe97a3052e847190a9775431292a3a3
SHA143edc451ac97365600391fa4af15476a30423ff6
SHA256473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
SHA51293ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB