Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 19:29
General
-
Target
JaffaCakes118_75322c14a10b2b96ce21eda6c19e92ba.dll
-
Size
1.3MB
-
MD5
75322c14a10b2b96ce21eda6c19e92ba
-
SHA1
87a0258a905cb7ce63ccb60070b036d43c2184f4
-
SHA256
e8ef13ec78a9d82e088ff03b53c6f8c2ff84ba2cbedc1c8b08971f88a68fc44a
-
SHA512
59a40f743edace4a52514b95b8ce821827a19827a16c0af57704908caebc1d1c0b67a79ff045805b5d5f1040cc75a730d0f19b6a6b14db9d24a2218ba632b3f5
-
SSDEEP
12288:M9bvAviE6/WFmTsg2t1TxzGIhRR/xSw7aRlVYxrx6:M9bN/Ypgg1TxqkR9xaEx
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_75322c14a10b2b96ce21eda6c19e92ba.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\PbItoxX\cmstp.exeC:\Users\Admin\AppData\Local\PbItoxX\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\FtxXGm8\tcmsetup.exeC:\Users\Admin\AppData\Local\FtxXGm8\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\aEA1cxZUP\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\aEA1cxZUP\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5faeffac157db691e66fde540cfc9f803
SHA1311b2f7e6f4348e3bda088e7dbbfd8f64e5e4e3a
SHA25606fc41664acdc9039b83c1a88ffc27533bd2921cb28d61fef76b6466866102ef
SHA512dfcb8161d4f013bcfe38b8d2efa862eca0af51483238b9ee71b5e3dbf447b360753be3056a92d6edec6b8bf17846cdeca6afbccbd1f0e6077f67b954d7fef34c
-
Filesize
16KB
MD558f3b915b9ae7d63431772c2616b0945
SHA16346e837da3b0f551becb7cac6d160e3063696e9
SHA256e243501ba2ef7a6f04f51410bb916faffe0ec23450a4d030ce6bfe747e544b39
SHA5127b09192af460c502d1a94989a0d06191c8c7a058ce3a4541e3f45960a1e12529d0cdaff9da3d5bacfdceed57aeb6dc9a159c6c0a95675c438f99bf7e418c6dc5
-
Filesize
1.3MB
MD57695bbc70b3ef2199f121f5910fdcc07
SHA1b1c5c3d6cb2fbacdf17e2b7dfad05ba0216b64a2
SHA25653aa33e9179c0453a16dbbe15b8b817b5db1e834035a30fb974a25005649a0a0
SHA5122599bcea2897096927f24e57bc019fa9e2e41a5977d547890f644a8408e33c7755390ccefe84786d33570f4eed0fde5efc68e91b7c016f5bec20173de0c0f94a
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
93KB
MD5d0e40a5a0c7dad2d6e5040d7fbc37533
SHA1b0eabbd37a97a1abcd90bd56394f5c45585699eb
SHA2562adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b
SHA5121191c2efcadd53b74d085612025c44b6cd54dd69493632950e30ada650d5ed79e3468c138f389cd3bc21ea103059a63eb38d9d919a62d932a38830c93f57731f
-
Filesize
1.3MB
MD53b1ffa458d4cf4f7002ec38ed839f2f9
SHA13c729fcac0a1f011a4e0a7175a65d39cd085951d
SHA25605f94110cf6b2c37fba1fc5378adb4196c8d6a9ffc27b9dc2a3b6bb1e33c87c6
SHA512887078cc927ad86deafec6215a8aec956055343795ed7e2404611ac61dd5a7af86cc99bd73d245a08136d4c40c844302cb168dcfa51af7c02aa4a612bb3be1a7
-
Filesize
1KB
MD5a3ed02fa0e9f63b608641d6b473ae0d2
SHA138079aa87d83c3a4fc1321a87bca62e0e1d5e250
SHA25615e726645e7f1cfa55e555adab3f1b0afcd784cc20448a79ad9a1229491231ea
SHA51229e94120985ec18432cc25349397a74b5d9fb824cea22000d6f6ba4ef30e512c2b104e3d7ad22b4a97611d54bcdbba36d682a85ff0e205db3d2715bc1a082e98
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB