Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_366c8c40bdb4c7e668db028c6b7a533c876c257a9fce0d03f0b541df7ebf49f3.dll
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_366c8c40bdb4c7e668db028c6b7a533c876c257a9fce0d03f0b541df7ebf49f3.dll
-
Size
171KB
-
MD5
6c82147dd277ac736371f61338eb3bab
-
SHA1
09d473b02bf525f3e95b825e5fdf12c91bb9ec61
-
SHA256
366c8c40bdb4c7e668db028c6b7a533c876c257a9fce0d03f0b541df7ebf49f3
-
SHA512
3372d626b5fabe15057a057b9fd1beccb55e15e6e64b09994eb1698d3b2921f20eaf688269bbb208b03f0363cccd31e390fc376ba199c49b84e60353d80f264d
-
SSDEEP
3072:li49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:lH9RVaPEmsdHdbQUbd2H3
Malware Config
Extracted
dridex
22201
128.199.200.38:443
192.163.233.216:6601
43.229.206.244:4125
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/744-1-0x00000000752A0000-0x00000000752D0000-memory.dmp dridex_ldr behavioral2/memory/744-2-0x00000000752A0000-0x00000000752D0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 4448 744 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2672 wrote to memory of 744 2672 rundll32.exe 83 PID 2672 wrote to memory of 744 2672 rundll32.exe 83 PID 2672 wrote to memory of 744 2672 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_366c8c40bdb4c7e668db028c6b7a533c876c257a9fce0d03f0b541df7ebf49f3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_366c8c40bdb4c7e668db028c6b7a533c876c257a9fce0d03f0b541df7ebf49f3.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 6683⤵
- Program crash
PID:4448
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 744 -ip 7441⤵PID:1796