Analysis
-
max time kernel
136s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 16:14
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f44794df5fad07be72c2fab48e911ecb3143ea806d048f1de564833387305029.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_f44794df5fad07be72c2fab48e911ecb3143ea806d048f1de564833387305029.dll
-
Size
2.0MB
-
MD5
67832be2c1542a234ddcea3340a644ac
-
SHA1
e36c6f05baef0b621be5d41ab28b22f03f7dcfd4
-
SHA256
f44794df5fad07be72c2fab48e911ecb3143ea806d048f1de564833387305029
-
SHA512
a2c4cb234c28e46792c4ae54e639427d4923f5cf5b3c2e5dc2d9a1670a2c76a5173aad82d5e0f4adebf18d07d462a52510fcb1a5c37f3c923f1b43e05b6255db
-
SSDEEP
6144:qpXjcPUqviYVZFiKXJxDPbOoJcfgQwJ2vkeDkCSHVmrOISZKByfjYoxj:qpXjcPl7FzHebpID
Malware Config
Extracted
trickbot
100021
rob142
181.129.85.98:443
189.112.119.205:443
189.51.118.78:443
186.121.214.106:443
49.176.188.184:443
61.69.102.170:443
213.32.252.221:443
89.46.216.2:443
103.36.79.3:443
103.108.97.51:443
95.140.217.242:443
41.175.22.226:443
190.109.169.161:443
186.159.12.18:443
190.109.171.17:443
181.196.148.202:443
186.47.75.58:443
186.42.212.30:443
190.214.21.14:443
187.108.32.133:443
201.184.226.74:443
186.159.5.177:443
- autorun
Signatures
-
Trickbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1500 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 628 wrote to memory of 2408 628 rundll32.exe 28 PID 628 wrote to memory of 2408 628 rundll32.exe 28 PID 628 wrote to memory of 2408 628 rundll32.exe 28 PID 628 wrote to memory of 2408 628 rundll32.exe 28 PID 628 wrote to memory of 2408 628 rundll32.exe 28 PID 628 wrote to memory of 2408 628 rundll32.exe 28 PID 628 wrote to memory of 2408 628 rundll32.exe 28 PID 2408 wrote to memory of 2076 2408 rundll32.exe 29 PID 2408 wrote to memory of 2076 2408 rundll32.exe 29 PID 2408 wrote to memory of 2076 2408 rundll32.exe 29 PID 2408 wrote to memory of 2076 2408 rundll32.exe 29 PID 2408 wrote to memory of 1500 2408 rundll32.exe 30 PID 2408 wrote to memory of 1500 2408 rundll32.exe 30 PID 2408 wrote to memory of 1500 2408 rundll32.exe 30 PID 2408 wrote to memory of 1500 2408 rundll32.exe 30 PID 2408 wrote to memory of 1500 2408 rundll32.exe 30 PID 2408 wrote to memory of 1500 2408 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f44794df5fad07be72c2fab48e911ecb3143ea806d048f1de564833387305029.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f44794df5fad07be72c2fab48e911ecb3143ea806d048f1de564833387305029.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2076
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-