Overview

overview

10

Static

static

3

26976ba397...18.dll

windows7-x64

10

26976ba397...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08-10-2024 22:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    26976ba397f41991ffdeeff1031bf052_JaffaCakes118.dll

  • Size

    973KB

  • MD5

    26976ba397f41991ffdeeff1031bf052

  • SHA1

    a0978b28fd4ccba8529a9aab00bc370abb1508ff

  • SHA256

    9277022581a6a6565e4a1f7dd5b2c499cf62fd8e176450c0f4b2dca9fc70ce47

  • SHA512

    8665cefa87ce3698443d317e50a71f6baf45467cd1271b2799b49259c634ef742fb1ba95916f482012dd877dec452ea5efdd95c77008e6d5d37a1566034f40ac

  • SSDEEP

    24576:NIuIxBOQNcKv8RtflMQazYZPT29BL0qNsX90nn:i0+YZr2DR6Xg

Score
10/10
dridexbotnetpayloadpersistence

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

    botnetpayload
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\26976ba397f41991ffdeeff1031bf052_JaffaCakes118.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3004
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2796
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2824
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1084
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:408
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2420
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2628
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2816
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1280-4-0x0000000077436000-0x0000000077437000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1280-5-0x00000000029B0000-0x00000000029B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1280-9-0x0000000077436000-0x0000000077437000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1280-10-0x0000000002970000-0x0000000002971000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3004-0-0x00000000001C0000-0x00000000001C7000-memory.dmp

    Filesize

    28KB

    Download

  • memory/3004-1-0x0000000140000000-0x00000001400FC000-memory.dmp

    Filesize

    1008KB

    Download

  • memory/3004-8-0x0000000140000000-0x00000001400FC000-memory.dmp

    Filesize

    1008KB

    Download