Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15-08-2024 11:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
99f900d6050311138fde067981255976_JaffaCakes118.dll
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
General
-
Target
99f900d6050311138fde067981255976_JaffaCakes118.dll
-
Size
282KB
-
MD5
99f900d6050311138fde067981255976
-
SHA1
2fb69cd16f43c981e1fd4d265928d4bf518ae7d2
-
SHA256
5c06b00830e828ac09b88c7afcd94dc5a28b238333400d51af06fda58d99b81d
-
SHA512
79c11ffb7bb9aa87fcebccf8c0a6769d570b0b39b8788f747306b0c91b83d5e7586715efe939b0563a56dddadf5c37438cde6b7165fcbe8085af49c915ea9fa0
-
SSDEEP
3072:XklIl0fRKmQuLz+jQavn5hM3k5+LwdT0V6X7vHrSA54mNY7S7p0ngeAg0Fujow3G:Umlc4/VPvP+L9V2/r8AOR3dLk0RO
Malware Config
Extracted
Family
icedid
C2
astedolo.asia
Signatures
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral1/memory/2648-2-0x0000000073FA0000-0x00000000744F3000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 32 IoCs
flow pid Process 3 2648 rundll32.exe 4 2648 rundll32.exe 6 2648 rundll32.exe 7 2648 rundll32.exe 9 2648 rundll32.exe 10 2648 rundll32.exe 12 2648 rundll32.exe 13 2648 rundll32.exe 15 2648 rundll32.exe 16 2648 rundll32.exe 20 2648 rundll32.exe 21 2648 rundll32.exe 23 2648 rundll32.exe 24 2648 rundll32.exe 25 2648 rundll32.exe 26 2648 rundll32.exe 28 2648 rundll32.exe 29 2648 rundll32.exe 31 2648 rundll32.exe 32 2648 rundll32.exe 34 2648 rundll32.exe 35 2648 rundll32.exe 37 2648 rundll32.exe 38 2648 rundll32.exe 39 2648 rundll32.exe 40 2648 rundll32.exe 42 2648 rundll32.exe 43 2648 rundll32.exe 45 2648 rundll32.exe 46 2648 rundll32.exe 48 2648 rundll32.exe 49 2648 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2648 3000 rundll32.exe 30 PID 3000 wrote to memory of 2648 3000 rundll32.exe 30 PID 3000 wrote to memory of 2648 3000 rundll32.exe 30 PID 3000 wrote to memory of 2648 3000 rundll32.exe 30 PID 3000 wrote to memory of 2648 3000 rundll32.exe 30 PID 3000 wrote to memory of 2648 3000 rundll32.exe 30 PID 3000 wrote to memory of 2648 3000 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\99f900d6050311138fde067981255976_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\99f900d6050311138fde067981255976_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2648
-