Analysis
-
max time kernel
62s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 23:20
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_fd46b8c3d900dbe1f9afc740e0c7a1546867b7f72bdba8b154981db64825ecc4.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_fd46b8c3d900dbe1f9afc740e0c7a1546867b7f72bdba8b154981db64825ecc4.dll
-
Size
161KB
-
MD5
1f631cb148ac86a2ad1e92567e774909
-
SHA1
c8aeef56bc3365f319ee56cb7b57fef5ae1a6fa2
-
SHA256
fd46b8c3d900dbe1f9afc740e0c7a1546867b7f72bdba8b154981db64825ecc4
-
SHA512
c591c562362e3710039c8321cbf46db0be44beecbb3db7a7b96e03234f73a7c7ba27597bc506c8195738deb3c1cf4a5db0e2f87473317c09e3d47607f1c0d7e0
-
SSDEEP
3072:tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym
Malware Config
Extracted
dridex
40111
107.172.227.10:443
172.93.133.123:2303
108.168.61.147:8172
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/2708-1-0x0000000074A90000-0x0000000074ABE000-memory.dmp dridex_ldr behavioral2/memory/2708-4-0x0000000074A90000-0x0000000074ABE000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4236 wrote to memory of 2708 4236 rundll32.exe 84 PID 4236 wrote to memory of 2708 4236 rundll32.exe 84 PID 4236 wrote to memory of 2708 4236 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fd46b8c3d900dbe1f9afc740e0c7a1546867b7f72bdba8b154981db64825ecc4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fd46b8c3d900dbe1f9afc740e0c7a1546867b7f72bdba8b154981db64825ecc4.dll,#12⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:2708
-