Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 08:30
Static task
static1
Behavioral task
behavioral1
Sample
f829e1a9cf136d94f832c275f6d1f008_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
f829e1a9cf136d94f832c275f6d1f008_JaffaCakes118.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
f829e1a9cf136d94f832c275f6d1f008_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f829e1a9cf136d94f832c275f6d1f008
-
SHA1
6f695e3924dbb1d6d216250ea8da39987a70cf4b
-
SHA256
2c59b6a90799fe245b4bcd608bab37b0a3750bacaa886eda9c1e32c9e8b6f84f
-
SHA512
d8f3f5cc1a8e616515f9cf5bb6934fa6c6627a16713bbefdcf7d81ecaf4f41b657490759ae089fdeaac5f960d19acd92dd25bf9385189c0b37a13ff7048bacd8
-
SSDEEP
12288:6yWeahQ/LWnzkXz5HYrniajhuSlHJzJBlPXXo/6aNdCaBSPZC1XZV72B4:HWeaZzqY7dhBjz/lfo/FIyXv72B4
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazarloader family
-
Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral2/memory/4540-0-0x0000022737FA0000-0x0000022737FDC000-memory.dmp BazarLoaderVar5 behavioral2/memory/4540-2-0x0000022737FA0000-0x0000022737FDC000-memory.dmp BazarLoaderVar5 -
Blocklisted process makes network request 26 IoCs
flow pid Process 12 4540 rundll32.exe 21 4540 rundll32.exe 35 4540 rundll32.exe 39 4540 rundll32.exe 42 4540 rundll32.exe 44 4540 rundll32.exe 46 4540 rundll32.exe 50 4540 rundll32.exe 54 4540 rundll32.exe 55 4540 rundll32.exe 58 4540 rundll32.exe 59 4540 rundll32.exe 60 4540 rundll32.exe 61 4540 rundll32.exe 62 4540 rundll32.exe 63 4540 rundll32.exe 64 4540 rundll32.exe 66 4540 rundll32.exe 67 4540 rundll32.exe 71 4540 rundll32.exe 72 4540 rundll32.exe 74 4540 rundll32.exe 75 4540 rundll32.exe 77 4540 rundll32.exe 78 4540 rundll32.exe 82 4540 rundll32.exe -
Tries to connect to .bazar domain 17 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 64 yellowdownpour81.bazar 66 yellowdownpour81.bazar 71 yellowdownpour81.bazar 72 yellowdownpour81.bazar 82 yellowdownpour81.bazar 50 greencloud46a.bazar 54 greencloud46a.bazar 63 yellowdownpour81.bazar 74 yellowdownpour81.bazar 77 yellowdownpour81.bazar 78 yellowdownpour81.bazar 59 whitestorm9p.bazar 61 yellowdownpour81.bazar 62 yellowdownpour81.bazar 58 whitestorm9p.bazar 67 yellowdownpour81.bazar 75 yellowdownpour81.bazar -
Unexpected DNS network traffic destination 17 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 198.50.135.212 Destination IP 195.10.195.195 Destination IP 103.1.206.179 Destination IP 217.160.188.24 Destination IP 37.252.191.197 Destination IP 194.36.144.87 Destination IP 81.169.136.222 Destination IP 94.16.114.254 Destination IP 94.247.43.254 Destination IP 195.10.195.195 Destination IP 194.36.144.87 Destination IP 94.16.114.254 Destination IP 65.21.1.106 Destination IP 195.10.195.195 Destination IP 172.98.193.62 Destination IP 194.36.144.87 Destination IP 91.217.137.37 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
description flow ioc HTTP URL 42 https://api.opennicproject.org/geoip/?bare&ipv=4