Analysis
-
max time kernel
93s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-11-2024 03:06
General
-
Target
a596169960aeede1bab8ee6fea3cac49_JaffaCakes118.dll
-
Size
288KB
-
MD5
a596169960aeede1bab8ee6fea3cac49
-
SHA1
94411a43f529e7918583fe38b3c01a98677b5ab8
-
SHA256
390145df647bf727bd629c4c4c77a211c0776f6b03eec501c35c377ed520165c
-
SHA512
e5e943f0e696f92443c05d5f67420e2502d203a87ee5cf3b9204377657d82d3cd1eef02ce532436ecb6b2fcbfad6ada79ed788b472d401566cb7355dbd3781ba
-
SSDEEP
3072:p6QlU5T0+vk+wYDgN3XwmbvV4Ynnbe9rhNifQMpnIjZ9jAPUn4CbwKL0Fo3dgqTx:pXEwZSZeKZVA6BNL0F1h31eMgIf0
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
128.199.54.51
161.35.152.204
161.35.95.166
whitestorm9p.bazar
yellowdownpour81.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazarloader family
-
Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a596169960aeede1bab8ee6fea3cac49_JaffaCakes118.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\a596169960aeede1bab8ee6fea3cac49_JaffaCakes118.dll,StartW {1DE4FD1F-5998-4F70-8DF2-DD168735B218}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB