Overview

overview

10

Static

static

3

0ef3890b05...18.exe

windows7-x64

10

0ef3890b05...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    02-05-2024 16:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe

  • Size

    382KB

  • MD5

    0ef3890b051c62c04435a5ab8cb15ec2

  • SHA1

    c810007de17fe76f2fca134d0a1003c790a616d9

  • SHA256

    b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b

  • SHA512

    e56f43ae5a2c19f1e5b74ab5018821257aac3a5d94daa2c656d6181d33250acfed04f48d7bd678ab946d7eb48204760cb488a24f3503919b13ea7438bd1f2bc0

  • SSDEEP

    6144:N3GXaEkS6acHhDbYIur4J4Zn4HSMz6gCz3FGIcAolpgVHMe4IuKKew8O/CTq:N4aW4uMz6DwAUOVHMe4938C

Score
10/10
icedidbankerloadertrojan

Malware Config

Extracted

Family

icedid

C2

wloppyload.top

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID First Stage Loader 2 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2920-3-0x0000000000760000-0x0000000000766000-memory.dmp
    Filesize

    24KB

    Download
  • memory/2920-6-0x0000000000750000-0x0000000000753000-memory.dmp
    Filesize

    12KB

    Download