Overview

overview

10

Static

static

3

56abafa430...18.exe

windows7-x64

10

56abafa430...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    18-05-2024 20:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    56abafa43027c3abd0513dbc41f1a84d_JaffaCakes118.exe

  • Size

    52KB

  • MD5

    56abafa43027c3abd0513dbc41f1a84d

  • SHA1

    1b023618921b0eab208060b41cfdf52b7b7796ca

  • SHA256

    badf5b6c2231f8b56f60d0e71cdadf4c0938626d39230776a6d5adb1f4c352f1

  • SHA512

    93bcbbc4c92bb0466a53dea28cded80d7c11492d8fa9c12c4de53c0b1f5363a2cb94d60218ea37e876f6cca1c4ac6c6ce4365f4af8757eeeab21367470b81b7e

  • SSDEEP

    768:cmuCT9rI4m5reZEddakwOMMkxv92w3QylggXv06DkzExr7j6ZmDWDHkQ37w:yCegudIGMMY9TDlgg/0QcHtDHk

Score
10/10
icedid2118099802bankerloadertrojan

Malware Config

Extracted

Family

icedid

Extracted

Family

icedid

Botnet

2118099802

C2

allpikoloserdzwe.cyou

sipmptomsledy.top
Attributes
  • auth_var

    1

  • url_path

    /audio/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID Second Stage Loader 3 IoCs
    loader
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56abafa43027c3abd0513dbc41f1a84d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\56abafa43027c3abd0513dbc41f1a84d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2908-9-0x0000000000460000-0x0000000000465000-memory.dmp
    Filesize

    20KB

    Download
  • memory/2908-8-0x00000000003F0000-0x00000000003F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2908-4-0x0000000001D10000-0x0000000001D16000-memory.dmp
    Filesize

    24KB

    Download
  • memory/2908-0-0x0000000000470000-0x0000000000478000-memory.dmp
    Filesize

    32KB

    Download