Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2024 00:34

General

  • Target

    JaffaCakes118_73e17b73cfd1de722549700c28785cffa9ae37ba4a47a0bc31a03e1311692708.dll

  • Size

    188KB

  • MD5

    49e92bffbcb37e6043a63cf3ae96ca3b

  • SHA1

    7f23a014e8943eb851b109aabf30157c5fa6140e

  • SHA256

    73e17b73cfd1de722549700c28785cffa9ae37ba4a47a0bc31a03e1311692708

  • SHA512

    8d3f4fc00188217e0f560bba642e2a09647ed5bdefb17c63e2d2d8f7d1a0aa1ce2fc56a8336aa77eb23caa9acd6ce115a0bbb66d6b404df2c94e9ca23afedaa1

  • SSDEEP

    3072:UA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoFo:UzIqATVfQeV2FZalKq6jtGJWuTmd

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.82.248.59:443

54.39.98.141:6602

103.109.247.8:10443

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex family
  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73e17b73cfd1de722549700c28785cffa9ae37ba4a47a0bc31a03e1311692708.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73e17b73cfd1de722549700c28785cffa9ae37ba4a47a0bc31a03e1311692708.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 308
        3⤵
        • Program crash
        PID:2448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2064-0-0x00000000000E0000-0x00000000000E6000-memory.dmp

    Filesize

    24KB

  • memory/2064-1-0x0000000075020000-0x0000000075050000-memory.dmp

    Filesize

    192KB

  • memory/2064-2-0x0000000075020000-0x0000000075050000-memory.dmp

    Filesize

    192KB

  • memory/2064-3-0x00000000000E0000-0x00000000000E6000-memory.dmp

    Filesize

    24KB