Analysis
-
max time kernel
108s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 22:54
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_80a83f3377163d0765e7584d081b22ee66590829b18075a969b8542546af7963.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_80a83f3377163d0765e7584d081b22ee66590829b18075a969b8542546af7963.dll
-
Size
204KB
-
MD5
76014d7d4c01273ec47ce86b0a01d500
-
SHA1
8372ee8f7d2c80aaaf018bfca2811964d22bb77d
-
SHA256
80a83f3377163d0765e7584d081b22ee66590829b18075a969b8542546af7963
-
SHA512
f04f6a2945c6309586c04b18e2bacfbe1bd19ff4df9006de64592428fdae2ac81281106f79077160c7d27c551396c4d5b81be06848310ff95ffb1db4f801a1da
-
SSDEEP
3072:A6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:AZuX6pEaeEDheWa+Jc9bhorfTw
Malware Config
Extracted
dridex
40111
45.58.56.12:443
162.241.54.59:6601
51.91.76.89:2303
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/3684-1-0x00000000754F0000-0x0000000075525000-memory.dmp dridex_ldr behavioral2/memory/3684-4-0x00000000754F0000-0x0000000075525000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2364 wrote to memory of 3684 2364 rundll32.exe 83 PID 2364 wrote to memory of 3684 2364 rundll32.exe 83 PID 2364 wrote to memory of 3684 2364 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80a83f3377163d0765e7584d081b22ee66590829b18075a969b8542546af7963.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80a83f3377163d0765e7584d081b22ee66590829b18075a969b8542546af7963.dll,#12⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3684
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
142 B 145 B 2 1
DNS Request
97.17.167.52.in-addr.arpa
DNS Request
97.17.167.52.in-addr.arpa
-
210 B 133 B 3 1
DNS Request
83.210.23.2.in-addr.arpa
DNS Request
83.210.23.2.in-addr.arpa
DNS Request
83.210.23.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
72.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
142 B 157 B 2 1
DNS Request
198.187.3.20.in-addr.arpa
DNS Request
198.187.3.20.in-addr.arpa
-
222 B 128 B 3 1
DNS Request
172.214.232.199.in-addr.arpa
DNS Request
172.214.232.199.in-addr.arpa
DNS Request
172.214.232.199.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa