Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 18:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ddd2eb2b4bd1f7c615e92e57d725768_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
7ddd2eb2b4bd1f7c615e92e57d725768_JaffaCakes118.dll
-
Size
211KB
-
MD5
7ddd2eb2b4bd1f7c615e92e57d725768
-
SHA1
99a81f0d385051b41df44a53a753b8c3e1862982
-
SHA256
3626c5c04745f7318a313d26345c7c16450ff57b1a22fba0e57f8e03de0b8946
-
SHA512
c95a1a32f8e32c0ef576420a9e80827a70007db83deb0251ba18c63f23e66777615a995156f84cf13ed46acf87c4e73ade3c17ee874c74e8660c266462759f36
-
SSDEEP
6144:6ZLwUyyWMa3NIBkL6LDW8dTZdw702edvxiuYOO6umz4N:6ZLwUyyHadIBkLIi8dTL2SvguYOO1mkN
Malware Config
Extracted
Family
icedid
C2
ldrstar.casa
Signatures
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral1/memory/2396-1-0x0000000074DC0000-0x0000000074E4C000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 36 IoCs
flow pid Process 3 2396 rundll32.exe 4 2396 rundll32.exe 6 2396 rundll32.exe 7 2396 rundll32.exe 9 2396 rundll32.exe 10 2396 rundll32.exe 12 2396 rundll32.exe 13 2396 rundll32.exe 17 2396 rundll32.exe 18 2396 rundll32.exe 19 2396 rundll32.exe 20 2396 rundll32.exe 22 2396 rundll32.exe 23 2396 rundll32.exe 25 2396 rundll32.exe 26 2396 rundll32.exe 28 2396 rundll32.exe 29 2396 rundll32.exe 31 2396 rundll32.exe 32 2396 rundll32.exe 33 2396 rundll32.exe 34 2396 rundll32.exe 36 2396 rundll32.exe 37 2396 rundll32.exe 39 2396 rundll32.exe 40 2396 rundll32.exe 42 2396 rundll32.exe 43 2396 rundll32.exe 45 2396 rundll32.exe 46 2396 rundll32.exe 47 2396 rundll32.exe 48 2396 rundll32.exe 50 2396 rundll32.exe 51 2396 rundll32.exe 53 2396 rundll32.exe 54 2396 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2396 1720 rundll32.exe 28 PID 1720 wrote to memory of 2396 1720 rundll32.exe 28 PID 1720 wrote to memory of 2396 1720 rundll32.exe 28 PID 1720 wrote to memory of 2396 1720 rundll32.exe 28 PID 1720 wrote to memory of 2396 1720 rundll32.exe 28 PID 1720 wrote to memory of 2396 1720 rundll32.exe 28 PID 1720 wrote to memory of 2396 1720 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ddd2eb2b4bd1f7c615e92e57d725768_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ddd2eb2b4bd1f7c615e92e57d725768_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
PID:2396
-