Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_866d1b583a73fe11957eed3da193fa48f101fbeecf065b5873a47497b88873ce.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_866d1b583a73fe11957eed3da193fa48f101fbeecf065b5873a47497b88873ce.dll
-
Size
184KB
-
MD5
f75bd3ee7bfe2f0dd0aec39dc7a3f5e8
-
SHA1
4b950d5c8423b7bca2b9b573f1df62d8cfa96158
-
SHA256
866d1b583a73fe11957eed3da193fa48f101fbeecf065b5873a47497b88873ce
-
SHA512
076d9d3790c51b2275066e1e065b88bccca651b7d5f4a563482ba2f2e31003a10cc4eb7199049970d0ef7956870637222f8adaff5cbd12a2c680b42b4aa11b70
-
SSDEEP
3072:uiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaoblzoxss7:uiLVCIT4WK2z1W+CUHZj4Skq/eaohoC
Malware Config
Extracted
dridex
22202
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/1988-1-0x0000000074D50000-0x0000000074D7F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 3100 1988 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2624 wrote to memory of 1988 2624 rundll32.exe 83 PID 2624 wrote to memory of 1988 2624 rundll32.exe 83 PID 2624 wrote to memory of 1988 2624 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_866d1b583a73fe11957eed3da193fa48f101fbeecf065b5873a47497b88873ce.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_866d1b583a73fe11957eed3da193fa48f101fbeecf065b5873a47497b88873ce.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 6163⤵
- Program crash
PID:3100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1988 -ip 19881⤵PID:5112