Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 16:07
General
-
Target
JaffaCakes118_27161434e84e258ee09d7b472052965c.dll
-
Size
1.1MB
-
MD5
27161434e84e258ee09d7b472052965c
-
SHA1
8d3c14960b77a4796d7e1c44b48c4e06dfda645b
-
SHA256
c567bcfe50a6894d43a4b85b302b6f76dc6376d64eb60270e92617a20c5a789c
-
SHA512
53b593cf1065ce170a5b077ee5646398c74c57801785baed5fe2afe604abd3d870eee5d56cbdb7762f57a642da95c00833ce1fd1f4bb13fb97e56b48ac8c9b87
-
SSDEEP
12288:2dMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:wMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27161434e84e258ee09d7b472052965c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\KXEOywF\rstrui.exeC:\Users\Admin\AppData\Local\KXEOywF\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\8GAtHzUe\cmstp.exeC:\Users\Admin\AppData\Local\8GAtHzUe\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\kItsYDLz\FXSCOVER.exeC:\Users\Admin\AppData\Local\kItsYDLz\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5a9f3a954ef923b10a4efc5a1f82d2ab2
SHA1e90bda8eb35b23a996e589fdab69962ce82a3a10
SHA2562545828f12a0bb75fa242a72dcd4d6b00a8911b041225e02943a72f47e2ac5ba
SHA51285ed0dcd396d44e09403624293f2437b42aa6b201158b2093c8a4a52808ddb9451f1c73ff3323e09db24270bfd498c83939d35fb0ecb2e5e0c1a68f2d86f7fb5
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
1.1MB
MD562b7c2542c55f9afb06d72a9d1e49d60
SHA15639859ec29c51e4d647383740d5cc71df7111aa
SHA256aec4bae736968274e0c122be437f58126d407d81660eb2b5763869ea52176879
SHA51202829fb4e3a90892d2189b7431931dc600d9d82b7c2c15730cd5f846613439964d4f96046510e377dce3ea003f5548e435b12412f0c1026c306b409a2d18b9bb
-
Filesize
268KB
MD54cad10846e93e85790865d5c0ab6ffd9
SHA18a223f4bab28afa4c7ed630f29325563c5dcda1a
SHA2569ddcfcaf2ebc810cc2e593446681bc4ccbad39756b1712cf045db8dee6310b4b
SHA512c0db44de0d35a70277f8621a318c5099378da675376e47545cfbfa7412e70a870fd05c92e0d6523ea2e0139d54d9eeaed14973762341fa3154406ae36f4ce7c6
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
1.1MB
MD5f2c14f8c67de02560d3cecd3c74f271d
SHA118577ca1055c2271c3993193201b635ac06c1623
SHA25686a9a1620d445788cdd768cf9b6718599610481705b80a2078841c90726ef8df
SHA51261afaa5f2e68e97beea872390c4c5f266d615031fddd3ceedeb0b2404f750903ce28c823fb1813ff4b936ea3fc1b6986b0171e5b9123e57a358ee473841d950d
-
Filesize
1KB
MD569802f3fc94cff5d9ee05d0823b3ddb4
SHA1effef12d0e8dc34743aef089680c03f34d3b2e69
SHA256e68eba8b8af431330a5e7990a9b5b889a7842d97612d0d350783877887d43b62
SHA512e7a7bb07cdbdb6c08801b2aea638b429a4bc5e4cb814492949e4a0c290f723a6f052739101236e25f6339d578e2dffcb724b7cf2118f78cef4eaa9b67a61f96e
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB