Overview

overview

10

Static

static

7

1d101557dc...18.dll

windows7-x64

10

1d101557dc...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-07-2024 00:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1d101557dc7b95085ba874ac4bdb38dc_JaffaCakes118.dll

  • Size

    3.0MB

  • MD5

    1d101557dc7b95085ba874ac4bdb38dc

  • SHA1

    d92e541c707cb8825860ba8f3bf801b06fb5b0c2

  • SHA256

    21249ce24600b1feac26a2a9883f3c6de299681a924be281630bc3869f0f4044

  • SHA512

    31dffd6ab386d1e6df37d9aa0333c2d16b3e154d2557bf1d8bb39ae313285ae4fc463a4ed92b8a86f39ff4a624d35dfc83c1b7567e634a96e29b47347e5d6e2f

  • SSDEEP

    49152:dqGB2KwBl+dyMzac4d12JVb4ZwDI0A3dQIOOtxE5/8ojWVVidT7gU9Y7xV:FB1wBlYykZ4L2JVkWQ3REJjWS7M7xV

Score
10/10
icedid620514333bankerloadertrojanvmprotect

Malware Config

Extracted

Family

icedid

Campaign

620514333

C2

oskolko.uno

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID First Stage Loader 1 IoCs
    loader
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1d101557dc7b95085ba874ac4bdb38dc_JaffaCakes118.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/376-0-0x00007FF9038A0000-0x00007FF903D10000-memory.dmp

    Filesize

    4.4MB

    Download