Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fb43bc53a57acd15ad463d2e6b7c511_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
5fb43bc53a57acd15ad463d2e6b7c511_JaffaCakes118.dll
-
Size
414KB
-
MD5
5fb43bc53a57acd15ad463d2e6b7c511
-
SHA1
4411257bd0758059737b7008e71a6b084b90418c
-
SHA256
b5399025d73dfb850df68017dfa81ce5f83bd9eeb7db056fffeca55ad3bcea65
-
SHA512
a82b20dba24e24b43c3cda3fef5a836d20e4acee06f1012e9486265ed8c6896f1902654cac3f0687cdf2fbcd955faaf003eec80f5d698dd783e6c4862a71f9e1
-
SSDEEP
6144:7l7Kr0ltJNgXq0KETxSInnNyduspvH/fN176+uCZV7T0zau/7Ia:7FKr0lt7g60vFSOA8spi+PZp0zau/7t
Malware Config
Extracted
Family
icedid
C2
ldrspace.casa
Signatures
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral1/memory/2888-0-0x00000000747F0000-0x00000000748B8000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 34 IoCs
flow pid Process 3 2888 rundll32.exe 4 2888 rundll32.exe 6 2888 rundll32.exe 7 2888 rundll32.exe 9 2888 rundll32.exe 10 2888 rundll32.exe 12 2888 rundll32.exe 13 2888 rundll32.exe 17 2888 rundll32.exe 18 2888 rundll32.exe 19 2888 rundll32.exe 20 2888 rundll32.exe 22 2888 rundll32.exe 23 2888 rundll32.exe 25 2888 rundll32.exe 26 2888 rundll32.exe 28 2888 rundll32.exe 29 2888 rundll32.exe 31 2888 rundll32.exe 32 2888 rundll32.exe 33 2888 rundll32.exe 34 2888 rundll32.exe 36 2888 rundll32.exe 37 2888 rundll32.exe 39 2888 rundll32.exe 40 2888 rundll32.exe 42 2888 rundll32.exe 43 2888 rundll32.exe 45 2888 rundll32.exe 46 2888 rundll32.exe 47 2888 rundll32.exe 48 2888 rundll32.exe 50 2888 rundll32.exe 51 2888 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2888 1708 rundll32.exe 28 PID 1708 wrote to memory of 2888 1708 rundll32.exe 28 PID 1708 wrote to memory of 2888 1708 rundll32.exe 28 PID 1708 wrote to memory of 2888 1708 rundll32.exe 28 PID 1708 wrote to memory of 2888 1708 rundll32.exe 28 PID 1708 wrote to memory of 2888 1708 rundll32.exe 28 PID 1708 wrote to memory of 2888 1708 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5fb43bc53a57acd15ad463d2e6b7c511_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5fb43bc53a57acd15ad463d2e6b7c511_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
PID:2888
-