Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61249740d1ecb3a12f4652e17c745802_JaffaCakes118.dll
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
61249740d1ecb3a12f4652e17c745802_JaffaCakes118.dll
-
Size
211KB
-
MD5
61249740d1ecb3a12f4652e17c745802
-
SHA1
7052e7962eab69ab2e6425a10931a008d4736284
-
SHA256
ab08d113bb0f4fb6aa96997d03853aac162f93d8e6926de224186ab35255f310
-
SHA512
90f56a0534297b6aaacc40573121e8c46e06ad4b3be8ce1a1eaf9ac788589a00f52cc6f1939b4dfde7c278e2d18fc80ddd84a2a01a05773487ba4912b1f11338
-
SSDEEP
6144:6ZLw/yyWMa3NIBkL6LDW8dTZdw702edvxiuYOO6umz4N:6ZLw/yyHadIBkLIi8dTL2SvguYOO1mkN
Malware Config
Extracted
Family
icedid
C2
ldrstar.casa
Signatures
-
IcedID First Stage Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4564-1-0x0000000074E10000-0x0000000074E9C000-memory.dmp IcedidFirstLoader behavioral2/memory/4564-2-0x0000000074E10000-0x0000000074E9C000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 16 IoCs
Processes:
rundll32.exeflow pid process 41 4564 rundll32.exe 43 4564 rundll32.exe 45 4564 rundll32.exe 48 4564 rundll32.exe 51 4564 rundll32.exe 54 4564 rundll32.exe 61 4564 rundll32.exe 63 4564 rundll32.exe 70 4564 rundll32.exe 72 4564 rundll32.exe 80 4564 rundll32.exe 93 4564 rundll32.exe 95 4564 rundll32.exe 98 4564 rundll32.exe 99 4564 rundll32.exe 101 4564 rundll32.exe -
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3772 4564 WerFault.exe rundll32.exe 1792 4564 WerFault.exe rundll32.exe 208 4564 WerFault.exe rundll32.exe 640 4564 WerFault.exe rundll32.exe 3272 4564 WerFault.exe rundll32.exe 4600 4564 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4472 wrote to memory of 4564 4472 rundll32.exe rundll32.exe PID 4472 wrote to memory of 4564 4472 rundll32.exe rundll32.exe PID 4472 wrote to memory of 4564 4472 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61249740d1ecb3a12f4652e17c745802_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61249740d1ecb3a12f4652e17c745802_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 6363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 7963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 7963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 12643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 9243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 12803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4564 -ip 45641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4564 -ip 45641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4564 -ip 45641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4564 -ip 45641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4564 -ip 45641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4564 -ip 45641⤵