Analysis
-
max time kernel
94s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/12/2024, 20:03
General
-
Target
JaffaCakes118_a676ae244b51645ac8ca2008baec89a30e732c89e2472d1f40ec8ed37310e0d6.dll
-
Size
188KB
-
MD5
fe036c837be8563866876e344c327fcb
-
SHA1
3d0400cf281d7b6d2d0a547abc40f81bbd5f2436
-
SHA256
a676ae244b51645ac8ca2008baec89a30e732c89e2472d1f40ec8ed37310e0d6
-
SHA512
f3d9cbfee4397f5bead0c8cb1a57310b0dd950c8e7dcc00a63ea2ace95053e44cf8beca7a56e09cfe9daa9e54160de6b9db04a12a05bf5977b99e3d465c924dc
-
SSDEEP
3072:EteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz29qM:4q7fYIHBZkTB6DWruUCOwjt
Malware Config
Extracted
dridex
22201
103.87.173.60:443
45.32.243.209:8116
207.180.208.54:4664
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 1 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a676ae244b51645ac8ca2008baec89a30e732c89e2472d1f40ec8ed37310e0d6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a676ae244b51645ac8ca2008baec89a30e732c89e2472d1f40ec8ed37310e0d6.dll,#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 6923⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1128 -ip 11281⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
192KB
-
Filesize
24KB