Analysis

  • max time kernel
    100s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-12-2024 19:41

General

  • Target

    JaffaCakes118_3b9f028b155287eff5b22c50588be224dfa293ecb7d4b94461bcb034fdf45645.exe

  • Size

    7.3MB

  • MD5

    1b729315f3fcb22b6b99b81c279daf4d

  • SHA1

    3d856820c1271e529e0d6cc974dc9fb2c969dcf0

  • SHA256

    3b9f028b155287eff5b22c50588be224dfa293ecb7d4b94461bcb034fdf45645

  • SHA512

    b8ba8c99eea65f22022e51d93b5ad3a577f15c2ae1fe476a935e26cfff7bd8038c3661d31a2ec9f2fb1ac2348e5d1434f2dba436c27933275b0fddb8adee03f9

  • SSDEEP

    196608:XmEgOzXX16SfEorayWPMemTfjDJExMXuq:XmEHzXFXso/mfmTbdEOXu

Malware Config

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b9f028b155287eff5b22c50588be224dfa293ecb7d4b94461bcb034fdf45645.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b9f028b155287eff5b22c50588be224dfa293ecb7d4b94461bcb034fdf45645.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:544
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 216
      2⤵
      • Program crash
      PID:3904
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 544 -ip 544
    1⤵
      PID:3528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/544-0-0x0000000000450000-0x0000000000BA3000-memory.dmp

      Filesize

      7.3MB