Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 12:54
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f.dll
-
Size
428KB
-
MD5
0ff1c8854048d8538d009fe6bee4f6d3
-
SHA1
455a044bd7562ead8a1a2d45c26eb2a5dcb33086
-
SHA256
73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f
-
SHA512
b6cf07bcc7b236d5fd40d2b790170293ae1654e9b3e12668250fbd18b5ecdd0dbf887a5d9ad6cf2d7fcfbd12155fd38ef2f779f9d66d1109fec8c95670a862c8
-
SSDEEP
12288:OQNFtqgBst6sev1QKI8BjI/Mf6KJ4N6aXf6XOu8O2ozfixQIhqSwLuWr:kgByg9fIyjso2TXfTJHkfDIhqmWr
Malware Config
Extracted
trickbot
100019
soh1
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Trickbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2304 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2284 2204 rundll32.exe 28 PID 2204 wrote to memory of 2284 2204 rundll32.exe 28 PID 2204 wrote to memory of 2284 2204 rundll32.exe 28 PID 2204 wrote to memory of 2284 2204 rundll32.exe 28 PID 2204 wrote to memory of 2284 2204 rundll32.exe 28 PID 2204 wrote to memory of 2284 2204 rundll32.exe 28 PID 2204 wrote to memory of 2284 2204 rundll32.exe 28 PID 2284 wrote to memory of 2276 2284 rundll32.exe 29 PID 2284 wrote to memory of 2276 2284 rundll32.exe 29 PID 2284 wrote to memory of 2276 2284 rundll32.exe 29 PID 2284 wrote to memory of 2276 2284 rundll32.exe 29 PID 2284 wrote to memory of 2304 2284 rundll32.exe 30 PID 2284 wrote to memory of 2304 2284 rundll32.exe 30 PID 2284 wrote to memory of 2304 2284 rundll32.exe 30 PID 2284 wrote to memory of 2304 2284 rundll32.exe 30 PID 2284 wrote to memory of 2304 2284 rundll32.exe 30 PID 2284 wrote to memory of 2304 2284 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2276
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-