Analysis
-
max time kernel
140s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 12:50
General
-
Target
3a1b1765146ef6fb64e7b69a31d235b9_JaffaCakes118.exe
-
Size
731KB
-
MD5
3a1b1765146ef6fb64e7b69a31d235b9
-
SHA1
a82a9dce4e0540ac4b2a3ab50b112595a3c24646
-
SHA256
0dab20133a70619c020226b57bdc9901bfb39c48b3b5d883403a79a5d4d02ea4
-
SHA512
e9a90c94144457d96145e8cc5e23e40a274c65c00ac0f904d79a621689f3ae3ffbc36705478d0d218b7e8741199f1a1b41394ea28230c348ff7bfd41223fce50
-
SSDEEP
12288:XM+ZdkmHubeaCo6zAO0s2A/sUQBJ8lgSVacsb0z:XMcpTo6zhL0BOlvkc1
Malware Config
Extracted
dridex
10111
172.104.58.76:6225
204.174.223.210:9043
51.91.105.97:8443
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a1b1765146ef6fb64e7b69a31d235b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a1b1765146ef6fb64e7b69a31d235b9_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
-
Filesize
244KB
-
Filesize
748KB
-
Filesize
244KB
-
Filesize
748KB