icedid | 433916382658909eddfca653bb6e6b951a7fec66020b205590a88883ad04d65e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29/07/2024, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5075e3a2ac31a24a7e702a9c874f6282_JaffaCakes118.exe
Size 142KB
Sample240729-s96rmswall
SHA256 433916382658909eddfca653bb6e6b951a7fec66020b205590a88883ad04d65e
MD5 5075e3a2ac31a24a7e702a9c874f6282
SHA1 e5b8c76e5dd399ddda7b0e90f8e437844cdd0634
SHA512 0193070874e3e6f64ac698407cc00667fd0e7a5a4bca32c4b54f38c4e25bece5314bf57c83fa9fe18e7c32273ffccfa08295188997d6b33f775fce62b9789714
SSDEEP 3072:YF+XutWYJ5mGCOdaurghr0cd1Pc/vyoS6OVXubST5DzBfO0r:OzoYaukl6io9O6Sl/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

icedid banker discovery loader trojan

Malware Config

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/1100-1-0x0000000000810000-0x00000000009A7000-memory.dmp	IcedidSecondLoader

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5075e3a2ac31a24a7e702a9c874f6282_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5075e3a2ac31a24a7e702a9c874f6282_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5075e3a2ac31a24a7e702a9c874f6282_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-0-0x0000000000832000-0x0000000000836000-memory.dmp

Download

memory/1100-1-0x0000000000810000-0x00000000009A7000-memory.dmp