Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

0e582f1d21...18.exe

windows7-x64

10

0e582f1d21...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2024, 11:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0e582f1d214712c263429692549010ef_JaffaCakes118.exe

  • Size

    228KB

  • MD5

    0e582f1d214712c263429692549010ef

  • SHA1

    50c8cbdaa3b781d00e6e8df336af7620fcb90136

  • SHA256

    fa79f39d2512326f3645ec051f32c4b0f175142bc5f43e0b869bdcfe32d18ca4

  • SHA512

    7eac85ab9f8e9ff4d7602569d363293639b997e609694ade84e8211aa9dddeec67984281f0775da6970d41e0ed9e13d6d845afaf14a3dbd1287b819d56c010ff

  • SSDEEP

    3072:UvbniW198DEYusGG2dIcnnhIm3fbk/1WJC6qidEIiCuCo3Bo84/X3wrbiW14:UJX8DAsGGDchISj95+CuYX/

Score
10/10
icedid3940132575bankerloadertrojan

Malware Config

Extracted

Family

icedid

Extracted

Family

icedid

Botnet

3940132575

C2

besitxavier.best

nazifestivo.best
Attributes
  • auth_var

    2

  • url_path

    /audio/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 3 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e582f1d214712c263429692549010ef_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0e582f1d214712c263429692549010ef_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1980-0-0x00000000024C0000-0x00000000024C8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1980-4-0x00000000024D0000-0x00000000024D6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1980-9-0x0000000002280000-0x0000000002285000-memory.dmp

    Filesize

    20KB

    Download

  • memory/1980-8-0x0000000000640000-0x0000000000641000-memory.dmp

    Filesize

    4KB

    Download