Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2024, 01:41 UTC

General

  • Target

    JaffaCakes118_cedc9a102695806c8f5e430584cf0e8d33b5d6369d3fd6fade14657c74a279f3.dll

  • Size

    170KB

  • MD5

    67ae13738950773d35a8ca6d31ed8a96

  • SHA1

    1d525bb48404dc6ed5f5dce659fa428286ecc45b

  • SHA256

    cedc9a102695806c8f5e430584cf0e8d33b5d6369d3fd6fade14657c74a279f3

  • SHA512

    1cca995067df6255e4d2270c3305940efa785bea2e6e292054cc84f002117a0b429c2bd240bcf7c9f9eda05ce07cf0b25075de2337a48171d2775421b3bcd86d

  • SSDEEP

    3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
1
13iy344i0phzqg3KDMwrVPQYVvhM8BSe44BE2Ue
rc4.plain
1
qzveOUCHZv0oEKCqUoGAAAOJttt6dYFXXWNqwFwgE7fqvzkveUGYimoTiKx5J4M7wJM

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex family
  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cedc9a102695806c8f5e430584cf0e8d33b5d6369d3fd6fade14657c74a279f3.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cedc9a102695806c8f5e430584cf0e8d33b5d6369d3fd6fade14657c74a279f3.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2216

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2216-0-0x00000000001A0000-0x00000000001A6000-memory.dmp

    Filesize

    24KB

  • memory/2216-1-0x0000000075120000-0x000000007514F000-memory.dmp

    Filesize

    188KB

  • memory/2216-3-0x00000000001A0000-0x00000000001A6000-memory.dmp

    Filesize

    24KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.