Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 09:22
Static task
static1
Behavioral task
behavioral1
Sample
617e1c5ceffdf4c2ec78c281c3372236_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
617e1c5ceffdf4c2ec78c281c3372236_JaffaCakes118.dll
-
Size
539KB
-
MD5
617e1c5ceffdf4c2ec78c281c3372236
-
SHA1
2cc5128182edb63db5caf362d71fdb6341120631
-
SHA256
6be8b6682317689d5f502805f34c96fa9487400df1c69bdc377837c3b90ee37c
-
SHA512
974584c9ab0a6bb7f4d6c7668dbf80652c08371413d249637b12e1296cc31496c05db86133e857ba64cd3d6bef05c62886f39123e6824224a2dcbf900e5dbbfe
-
SSDEEP
6144:6kF19P2yLnafTR93YBgobwN+5AxtyTCjzVm8Ntk8IgJ0gK:6kFne883YdbY+5QyTE1tktyd
Malware Config
Extracted
dridex
10444
162.241.44.26:9443
192.232.229.53:4443
77.220.64.34:443
193.90.12.121:3098
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2340 wrote to memory of 512 2340 rundll32.exe 84 PID 2340 wrote to memory of 512 2340 rundll32.exe 84 PID 2340 wrote to memory of 512 2340 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\617e1c5ceffdf4c2ec78c281c3372236_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\617e1c5ceffdf4c2ec78c281c3372236_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:512
-