Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 23:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1cfba0904f4423463f764a11a6fd4251_JaffaCakes118.dll
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
1cfba0904f4423463f764a11a6fd4251_JaffaCakes118.dll
-
Size
920KB
-
MD5
1cfba0904f4423463f764a11a6fd4251
-
SHA1
a00c004b4de481c921c5ad2c98dcd87724b4b0a1
-
SHA256
30b6438b14eac5337f6d0f81997a4fce356611fc19155ae3650d5df21e894e74
-
SHA512
cc902fe1d2206b0f584fe3c0ba3874db4189a4f226da4c54a2a632deb719bb3d58cf934b467c58ad2d0ffcdd2672aef96b79e118c17a067d05ead2e4a3879a5f
-
SSDEEP
24576:bwWfnaVoffEQmyO378WTkvEKT9Hgce1BHboDCm:cuaq34yDWTkvvT9HgdboDC
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
209.20.87.138:443
198.1.115.153:8172
151.236.29.248:6516
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 43 4588 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4912 wrote to memory of 4588 4912 rundll32.exe rundll32.exe PID 4912 wrote to memory of 4588 4912 rundll32.exe rundll32.exe PID 4912 wrote to memory of 4588 4912 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1cfba0904f4423463f764a11a6fd4251_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1cfba0904f4423463f764a11a6fd4251_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4588-0-0x0000000075790000-0x00000000758D1000-memory.dmpFilesize
1.3MB
-
memory/4588-2-0x0000000075875000-0x0000000075879000-memory.dmpFilesize
16KB
-
memory/4588-3-0x0000000075790000-0x00000000758D1000-memory.dmpFilesize
1.3MB
-
memory/4588-4-0x0000000075790000-0x00000000758D1000-memory.dmpFilesize
1.3MB