Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 23:15
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_99581e569e8474756baddc69956a94af4bb2a0121b3cea8fec903f89d240a30b.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_99581e569e8474756baddc69956a94af4bb2a0121b3cea8fec903f89d240a30b.dll
-
Size
188KB
-
MD5
049a747cd02e62de7aa52c7049bb94b8
-
SHA1
724d4fccdb75fe3bdba13b5c09ecb43a3da794ae
-
SHA256
99581e569e8474756baddc69956a94af4bb2a0121b3cea8fec903f89d240a30b
-
SHA512
31eb2b8dbc76e76f8dd02117e9af99ffa3825f49c3809e8f0b29bd73de0bffa378b1e1fdf338258f7c631a91987672b9fd24aa8095632d424ffd3dea2808d7d5
-
SSDEEP
3072:eteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzV9qM:Wq7fYIHBZkTB6DWruUCOwjt
Malware Config
Extracted
dridex
22201
103.87.173.60:443
45.32.243.209:8116
207.180.208.54:4664
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/2252-1-0x00000000747F0000-0x0000000074820000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2700 2252 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2252 2220 rundll32.exe 30 PID 2220 wrote to memory of 2252 2220 rundll32.exe 30 PID 2220 wrote to memory of 2252 2220 rundll32.exe 30 PID 2220 wrote to memory of 2252 2220 rundll32.exe 30 PID 2220 wrote to memory of 2252 2220 rundll32.exe 30 PID 2220 wrote to memory of 2252 2220 rundll32.exe 30 PID 2220 wrote to memory of 2252 2220 rundll32.exe 30 PID 2252 wrote to memory of 2700 2252 rundll32.exe 31 PID 2252 wrote to memory of 2700 2252 rundll32.exe 31 PID 2252 wrote to memory of 2700 2252 rundll32.exe 31 PID 2252 wrote to memory of 2700 2252 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_99581e569e8474756baddc69956a94af4bb2a0121b3cea8fec903f89d240a30b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_99581e569e8474756baddc69956a94af4bb2a0121b3cea8fec903f89d240a30b.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 3003⤵
- Program crash
PID:2700
-
-