Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 11:49
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_38685538309c842e1ff50dc04cf4c9c9bb71ca4484eb18122e4c672229dd2e40.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_38685538309c842e1ff50dc04cf4c9c9bb71ca4484eb18122e4c672229dd2e40.dll
-
Size
440KB
-
MD5
c56caa45c5e83c9f04e184b5af031cbe
-
SHA1
2e9d378d1ae71bf8099db20ffe850b832e0877f5
-
SHA256
38685538309c842e1ff50dc04cf4c9c9bb71ca4484eb18122e4c672229dd2e40
-
SHA512
4cf5123bb2b0b771f07af146bc65ae62b9a1f537b4b4f461a7d42b35e32e8aeea1cc641073b40b3d0878a02775025580f00bcb6ebc624f82c7e8889129eddeff
-
SSDEEP
6144:v5+iRFTkRhO9SEDtZtfherliYSuTNpBRaj4gzaxCdKJjWJFWMaDTX3H:JFTkCtZTm4EBpL0zacMScx7
Malware Config
Extracted
trickbot
100019
rob141
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Trickbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2924 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1568 2236 rundll32.exe 30 PID 2236 wrote to memory of 1568 2236 rundll32.exe 30 PID 2236 wrote to memory of 1568 2236 rundll32.exe 30 PID 2236 wrote to memory of 1568 2236 rundll32.exe 30 PID 2236 wrote to memory of 1568 2236 rundll32.exe 30 PID 2236 wrote to memory of 1568 2236 rundll32.exe 30 PID 2236 wrote to memory of 1568 2236 rundll32.exe 30 PID 1568 wrote to memory of 2540 1568 rundll32.exe 31 PID 1568 wrote to memory of 2540 1568 rundll32.exe 31 PID 1568 wrote to memory of 2540 1568 rundll32.exe 31 PID 1568 wrote to memory of 2540 1568 rundll32.exe 31 PID 1568 wrote to memory of 2924 1568 rundll32.exe 32 PID 1568 wrote to memory of 2924 1568 rundll32.exe 32 PID 1568 wrote to memory of 2924 1568 rundll32.exe 32 PID 1568 wrote to memory of 2924 1568 rundll32.exe 32 PID 1568 wrote to memory of 2924 1568 rundll32.exe 32 PID 1568 wrote to memory of 2924 1568 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_38685538309c842e1ff50dc04cf4c9c9bb71ca4484eb18122e4c672229dd2e40.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_38685538309c842e1ff50dc04cf4c9c9bb71ca4484eb18122e4c672229dd2e40.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2540
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-