Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-09-2024 12:55

General

  • Target

    e92a56600266f295094dfbf8f2dce8d3_JaffaCakes118.dll

  • Size

    1.4MB

  • MD5

    e92a56600266f295094dfbf8f2dce8d3

  • SHA1

    52db6d1d6db1e21c1cc8a90b275522eed96e04e2

  • SHA256

    526ebbf20321313197a89bbac67ecc6b3289419dfc06b67031c9d838a355e1ff

  • SHA512

    5d24771e4232982f1cfb60393826f18c5934840910dafb07cb6e1de8a6932681bd5636ef60e3f413ad2c8b57b451982d59f75dc988693fd757ce12594025990f

  • SSDEEP

    24576:OuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:u9cKrUqZWLAcU

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e92a56600266f295094dfbf8f2dce8d3_JaffaCakes118.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4024
  • C:\Windows\system32\EhStorAuthn.exe
    C:\Windows\system32\EhStorAuthn.exe
    1⤵
      PID:3580
    • C:\Users\Admin\AppData\Local\be5m\EhStorAuthn.exe
      C:\Users\Admin\AppData\Local\be5m\EhStorAuthn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:2756
    • C:\Windows\system32\cmstp.exe
      C:\Windows\system32\cmstp.exe
      1⤵
        PID:992
      • C:\Users\Admin\AppData\Local\Zu4Mmh7s\cmstp.exe
        C:\Users\Admin\AppData\Local\Zu4Mmh7s\cmstp.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:3368
      • C:\Windows\system32\bdechangepin.exe
        C:\Windows\system32\bdechangepin.exe
        1⤵
          PID:820
        • C:\Users\Admin\AppData\Local\KtdCULRX\bdechangepin.exe
          C:\Users\Admin\AppData\Local\KtdCULRX\bdechangepin.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:3512

        Network

        • flag-us
          DNS
          228.249.119.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          228.249.119.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          36.56.20.217.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          36.56.20.217.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          83.177.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          83.177.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          97.17.167.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          97.17.167.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          86.23.85.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          86.23.85.13.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          198.187.3.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          198.187.3.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          172.214.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.214.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          25.140.123.92.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          25.140.123.92.in-addr.arpa
          IN PTR
          Response
          25.140.123.92.in-addr.arpa
          IN PTR
          a92-123-140-25deploystaticakamaitechnologiescom
        • flag-us
          DNS
          13.227.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          13.227.111.52.in-addr.arpa
          IN PTR
          Response
        • 52.111.229.43:443
          322 B
          7
        • 8.8.8.8:53
          228.249.119.40.in-addr.arpa
          dns
          73 B
          159 B
          1
          1

          DNS Request

          228.249.119.40.in-addr.arpa

        • 8.8.8.8:53
          36.56.20.217.in-addr.arpa
          dns
          71 B
          131 B
          1
          1

          DNS Request

          36.56.20.217.in-addr.arpa

        • 8.8.8.8:53
          83.177.190.20.in-addr.arpa
          dns
          72 B
          158 B
          1
          1

          DNS Request

          83.177.190.20.in-addr.arpa

        • 8.8.8.8:53
          97.17.167.52.in-addr.arpa
          dns
          71 B
          145 B
          1
          1

          DNS Request

          97.17.167.52.in-addr.arpa

        • 8.8.8.8:53
          86.23.85.13.in-addr.arpa
          dns
          70 B
          144 B
          1
          1

          DNS Request

          86.23.85.13.in-addr.arpa

        • 8.8.8.8:53
          198.187.3.20.in-addr.arpa
          dns
          71 B
          157 B
          1
          1

          DNS Request

          198.187.3.20.in-addr.arpa

        • 8.8.8.8:53
          172.214.232.199.in-addr.arpa
          dns
          74 B
          128 B
          1
          1

          DNS Request

          172.214.232.199.in-addr.arpa

        • 8.8.8.8:53
          25.140.123.92.in-addr.arpa
          dns
          72 B
          137 B
          1
          1

          DNS Request

          25.140.123.92.in-addr.arpa

        • 8.8.8.8:53
          13.227.111.52.in-addr.arpa
          dns
          72 B
          158 B
          1
          1

          DNS Request

          13.227.111.52.in-addr.arpa

        • 8.8.8.8:53

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\KtdCULRX\DUI70.dll

          Filesize

          1.6MB

          MD5

          ffb0554cef93fc4a3e59de4a42a5fff7

          SHA1

          f7597286e6b3c7831028a9a69c81a65371d98927

          SHA256

          c3aa41fe13e9071746a07554f139b55d1467519d4f625b38f0719a23ccf663da

          SHA512

          e9dfb67b2782daaaa8ff9bffc576f93d9de7f23fec14d0b17ee33a0fdc0c8e54809b44a5b7f5cfe7db6bcd59eaf271eca3dc42cdf11bea0df782ee1a18daffd0

        • C:\Users\Admin\AppData\Local\KtdCULRX\bdechangepin.exe

          Filesize

          373KB

          MD5

          601a28eb2d845d729ddd7330cbae6fd6

          SHA1

          5cf9f6f9135c903d42a7756c638333db8621e642

          SHA256

          4d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6

          SHA512

          1687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d

        • C:\Users\Admin\AppData\Local\Zu4Mmh7s\VERSION.dll

          Filesize

          1.4MB

          MD5

          c2a286dee73536fb9384b2f3ec520863

          SHA1

          0fa09ec4d9f275a259dcb73f1e0190e28beeb303

          SHA256

          c0566b92f937c5517193923632c151155bbbf236e3441834198c06cb0a14957d

          SHA512

          7ff8d76ae106686228dadf33f910644f152244ece3602fb5096161863a531e4fdb7e2705e53f37a18c7b2c81ad4f11eec4b9d978805c2f0c390f02d0335c5635

        • C:\Users\Admin\AppData\Local\Zu4Mmh7s\cmstp.exe

          Filesize

          96KB

          MD5

          4cc43fe4d397ff79fa69f397e016df52

          SHA1

          8fd6cf81ad40c9b123cd75611860a8b95c72869c

          SHA256

          f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c

          SHA512

          851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157

        • C:\Users\Admin\AppData\Local\be5m\EhStorAuthn.exe

          Filesize

          128KB

          MD5

          d45618e58303edb4268a6cca5ec99ecc

          SHA1

          1f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513

          SHA256

          d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c

          SHA512

          5d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd

        • C:\Users\Admin\AppData\Local\be5m\UxTheme.dll

          Filesize

          1.4MB

          MD5

          555b9c110795f9386e1b8b97c4276f88

          SHA1

          0574473ce07e9b43a15abc674cdc4770a455bb6b

          SHA256

          4d00d412492f362ede772fdf369021cb14f19f132e9e1895be36de4f3bcf8e23

          SHA512

          bb4c17ed15eeb083e4c7b9b044f2f9c961c07817645791efbcaa77a8e93f9036bb5d5a10b6de96b2ad5c1122e9cb09a0b934be7a568a754649e8282ca02d9040

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Plbydas.lnk

          Filesize

          989B

          MD5

          a4558a7da6d25ee8fddd173367ae4475

          SHA1

          3a98386aeff12a99989995af52508d3538f28e09

          SHA256

          60d7ad9d99d23d31ec3f03db8da06ded4448289897abcd9c6b0551a25d22f980

          SHA512

          afcbec356fb21c0c2681a6fed589f7320118a191c64d2a6e81fa15045d65dd8df555d4d5dbb4cd20bcb08ef9e5eae7b0916db76c8fff9f77c7e67cee3dd6fa02

        • memory/2756-52-0x00007FFB51B90000-0x00007FFB51CF5000-memory.dmp

          Filesize

          1.4MB

        • memory/2756-47-0x00007FFB51B90000-0x00007FFB51CF5000-memory.dmp

          Filesize

          1.4MB

        • memory/2756-46-0x0000028BEADA0000-0x0000028BEADA7000-memory.dmp

          Filesize

          28KB

        • memory/3368-70-0x00007FFB51B90000-0x00007FFB51CF5000-memory.dmp

          Filesize

          1.4MB

        • memory/3368-64-0x0000021F33EF0000-0x0000021F33EF7000-memory.dmp

          Filesize

          28KB

        • memory/3376-30-0x00000000004F0000-0x00000000004F7000-memory.dmp

          Filesize

          28KB

        • memory/3376-25-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-12-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-11-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-9-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-8-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-7-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-4-0x0000000002450000-0x0000000002451000-memory.dmp

          Filesize

          4KB

        • memory/3376-14-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-16-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-17-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-13-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-5-0x00007FFB6E27A000-0x00007FFB6E27B000-memory.dmp

          Filesize

          4KB

        • memory/3376-36-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-31-0x00007FFB6FDB0000-0x00007FFB6FDC0000-memory.dmp

          Filesize

          64KB

        • memory/3376-15-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3376-10-0x0000000140000000-0x0000000140164000-memory.dmp

          Filesize

          1.4MB

        • memory/3512-81-0x00007FFB51B50000-0x00007FFB51CFA000-memory.dmp

          Filesize

          1.7MB

        • memory/3512-84-0x000001ADDE3A0000-0x000001ADDE3A7000-memory.dmp

          Filesize

          28KB

        • memory/3512-87-0x00007FFB51B50000-0x00007FFB51CFA000-memory.dmp

          Filesize

          1.7MB

        • memory/4024-0-0x00007FFB616D0000-0x00007FFB61834000-memory.dmp

          Filesize

          1.4MB

        • memory/4024-39-0x00007FFB616D0000-0x00007FFB61834000-memory.dmp

          Filesize

          1.4MB

        • memory/4024-3-0x0000021B41630000-0x0000021B41637000-memory.dmp

          Filesize

          28KB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.