Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 11:40
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_56c03ca590194ca165112aa84853b2452722847634d7058bec4c6163ad4b51d0.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_56c03ca590194ca165112aa84853b2452722847634d7058bec4c6163ad4b51d0.dll
-
Size
163KB
-
MD5
7186cabce266492392e289c923ad7682
-
SHA1
e845608d767e5079221e97b99434c5f84bf4dd16
-
SHA256
56c03ca590194ca165112aa84853b2452722847634d7058bec4c6163ad4b51d0
-
SHA512
0ccdd537cc27d02f708dbdfdc8150a67fb70175b88181bed89a1a5d986bce3eb17c697b05f8310217445d59e913965f226009ffa49f2ba4d797153f543faa1f7
-
SSDEEP
3072:car6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:+s4p+ADxnSO6D2cOp
Malware Config
Extracted
dridex
22202
43.229.206.212:443
82.209.17.209:8172
162.241.209.225:4125
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/2588-0-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1548 2588 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3984 wrote to memory of 2588 3984 rundll32.exe 82 PID 3984 wrote to memory of 2588 3984 rundll32.exe 82 PID 3984 wrote to memory of 2588 3984 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_56c03ca590194ca165112aa84853b2452722847634d7058bec4c6163ad4b51d0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_56c03ca590194ca165112aa84853b2452722847634d7058bec4c6163ad4b51d0.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 7163⤵
- Program crash
PID:1548
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2588 -ip 25881⤵PID:4608