Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 21:50
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_2b81efeac1fd34fb5ece8704dde303dfaabcac2fc074f8462aeb620c70ab9f7d.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_2b81efeac1fd34fb5ece8704dde303dfaabcac2fc074f8462aeb620c70ab9f7d.dll
-
Size
184KB
-
MD5
026aa1bc331de85a035dc1eae986a310
-
SHA1
d308cb3dcf5839f0d65f1856a18dab532be0356b
-
SHA256
2b81efeac1fd34fb5ece8704dde303dfaabcac2fc074f8462aeb620c70ab9f7d
-
SHA512
ad1950a3ec86e3ff7a1087807a83b382e4e0f0ff45c24d56365bfe2b77443c8baa6e09f9bfa132a4198854190eb949e6c19bed79f663a6b6aa690799ddaf25b2
-
SSDEEP
3072:fiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaoglzoxss7:fiLVCIT4WK2z1W+CUHZj4Skq/eaoeoC
Malware Config
Extracted
dridex
22202
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/5076-1-0x0000000074F20000-0x0000000074F4F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 3424 5076 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5104 wrote to memory of 5076 5104 rundll32.exe 83 PID 5104 wrote to memory of 5076 5104 rundll32.exe 83 PID 5104 wrote to memory of 5076 5104 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b81efeac1fd34fb5ece8704dde303dfaabcac2fc074f8462aeb620c70ab9f7d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b81efeac1fd34fb5ece8704dde303dfaabcac2fc074f8462aeb620c70ab9f7d.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 6163⤵
- Program crash
PID:3424
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5076 -ip 50761⤵PID:3464