Analysis
-
max time kernel
95s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 23:26
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f1076cbf8e0783024c9cb3ef3cd01e60520f98d32364ecbbabf2e1e03797288d.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_f1076cbf8e0783024c9cb3ef3cd01e60520f98d32364ecbbabf2e1e03797288d.dll
-
Size
188KB
-
MD5
7af1934c788c4db51b6856d570f64263
-
SHA1
45c1012a086051c1608a03500342acd2386c9d1a
-
SHA256
f1076cbf8e0783024c9cb3ef3cd01e60520f98d32364ecbbabf2e1e03797288d
-
SHA512
eebde09382d5e4aa0bfaafb8bf637ff297b68e0f48f7d5584d217d8634596ff1f93d54abcf521c46379d0f6b726a47e2329b14756f127bd29819c5f39b5ce08b
-
SSDEEP
3072:UA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAogo:UzIqATVfQeV2FZalKq6jtGJWuTmd
Malware Config
Extracted
dridex
22201
103.82.248.59:443
54.39.98.141:6602
103.109.247.8:10443
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/2876-0-0x0000000074FD0000-0x0000000075000000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 3512 2876 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2876 2408 rundll32.exe 82 PID 2408 wrote to memory of 2876 2408 rundll32.exe 82 PID 2408 wrote to memory of 2876 2408 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1076cbf8e0783024c9cb3ef3cd01e60520f98d32364ecbbabf2e1e03797288d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1076cbf8e0783024c9cb3ef3cd01e60520f98d32364ecbbabf2e1e03797288d.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 6923⤵
- Program crash
PID:3512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2876 -ip 28761⤵PID:3552
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request4.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request180.129.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request20.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
4.159.190.20.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
180.129.81.91.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
20.49.80.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa