Analysis
-
max time kernel
94s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_ffb027e145baa8496b74e2cfb2543ee0f0d0378795212ef1176c8ecac57c6755.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_ffb027e145baa8496b74e2cfb2543ee0f0d0378795212ef1176c8ecac57c6755.dll
-
Size
204KB
-
MD5
b77d3a8a44ee9c82f77ef382f410b576
-
SHA1
47fd3ad86cb9a3c41fda55b3cca1311d91377d94
-
SHA256
ffb027e145baa8496b74e2cfb2543ee0f0d0378795212ef1176c8ecac57c6755
-
SHA512
fa501f1342a6116ed3ca5d71a679892441f73083a22e243c1a00927a0fe30ab0d4487a326e6c5987ecf661247224242028b3d2ece53e823311d2a8053127ee90
-
SSDEEP
3072:v6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:vZuX6pEaeEDheWa+Jc9bhorfTw
Malware Config
Extracted
dridex
40111
45.58.56.12:443
162.241.54.59:6601
51.91.76.89:2303
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/2176-1-0x0000000075880000-0x00000000758B5000-memory.dmp dridex_ldr behavioral2/memory/2176-4-0x0000000075880000-0x00000000758B5000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2176 2204 rundll32.exe 83 PID 2204 wrote to memory of 2176 2204 rundll32.exe 83 PID 2204 wrote to memory of 2176 2204 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ffb027e145baa8496b74e2cfb2543ee0f0d0378795212ef1176c8ecac57c6755.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ffb027e145baa8496b74e2cfb2543ee0f0d0378795212ef1176c8ecac57c6755.dll,#12⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:2176
-