Analysis
-
max time kernel
93s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2024 23:50
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f492dcea11074cc66d72a67d1dc03f1327dcebe59e37eeeecbbcded2f7501939.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_f492dcea11074cc66d72a67d1dc03f1327dcebe59e37eeeecbbcded2f7501939.dll
-
Size
161KB
-
MD5
ced731574f3d07ffd5e5e944c492643c
-
SHA1
0e581b0cee38e2ec986d6d22e5749af3d52e802a
-
SHA256
f492dcea11074cc66d72a67d1dc03f1327dcebe59e37eeeecbbcded2f7501939
-
SHA512
99d440dc5f57977753a7ea979f2c6ad46ee68d3450966fbb7ee4eed8e3b74a5ede83174e3ad233c5cccf4537cf5ed9bf4c094bca0f56d9d5f11540aa072d38a9
-
SSDEEP
3072:5tSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2TGkFY:znS62Fl+pkeJl3CvRStrFl+EYi
Malware Config
Extracted
dridex
22202
78.46.73.125:443
185.148.168.26:2303
66.113.160.126:8172
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/4468-1-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr behavioral2/memory/4468-2-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 5072 4468 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1276 wrote to memory of 4468 1276 rundll32.exe 83 PID 1276 wrote to memory of 4468 1276 rundll32.exe 83 PID 1276 wrote to memory of 4468 1276 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f492dcea11074cc66d72a67d1dc03f1327dcebe59e37eeeecbbcded2f7501939.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f492dcea11074cc66d72a67d1dc03f1327dcebe59e37eeeecbbcded2f7501939.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 7123⤵
- Program crash
PID:5072
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4468 -ip 44681⤵PID:2132
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request181.129.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
22.160.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
217.106.137.52.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
181.129.81.91.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa