Analysis
-
max time kernel
94s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2024 13:45
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_62fa8e17d590535bb39b76a23670d8558db25b7bf15c42d4e657fd75abebd52d.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_62fa8e17d590535bb39b76a23670d8558db25b7bf15c42d4e657fd75abebd52d.dll
-
Size
184KB
-
MD5
e952fbd65d95b492ee1a1be94394569f
-
SHA1
966fe8fdaf5897eb88237011ed8d232aef1c2eb6
-
SHA256
62fa8e17d590535bb39b76a23670d8558db25b7bf15c42d4e657fd75abebd52d
-
SHA512
2f7d3605e46291e6017daac2b4f3636dd6194165ae1a387877cf9278d320231afffbc84afe7902749bdf4ca02c7d3320b00d21fd4aeb6287a8deb65b89e8143e
-
SSDEEP
3072:TiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaoulzoxss7:TiLVCIT4WK2z1W+CUHZj4Skq/eaosoC
Malware Config
Extracted
dridex
22202
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/4992-0-0x0000000074950000-0x000000007497F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 4288 4992 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1572 wrote to memory of 4992 1572 rundll32.exe 83 PID 1572 wrote to memory of 4992 1572 rundll32.exe 83 PID 1572 wrote to memory of 4992 1572 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62fa8e17d590535bb39b76a23670d8558db25b7bf15c42d4e657fd75abebd52d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62fa8e17d590535bb39b76a23670d8558db25b7bf15c42d4e657fd75abebd52d.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 6243⤵
- Program crash
PID:4288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4992 -ip 49921⤵PID:4044