Analysis
-
max time kernel
90s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08-09-2024 09:30
General
-
Target
d40ab1b49cd288ceb9e916ee64799ae1_JaffaCakes118.exe
-
Size
64KB
-
MD5
d40ab1b49cd288ceb9e916ee64799ae1
-
SHA1
e34edbe081b6639f54347aa8a5f804a792af2efd
-
SHA256
6e19add81ea292a2e62357b9929a850ec4ed16f12040f49a5bbe0f1038812c42
-
SHA512
8cc7c518541b3741b860e299b6de61e89dce19ba7ef20285c15d9b43d6d59d42dc2c7c7b9f9b6704cf105f4e8eb8bc3a8c552734caa214359f625fe9f2393c94
-
SSDEEP
1536:ngA2vszzHtCgBrNFLb2a3BqdY9URm4nRCoii0xGRxGThG0hGrCdb9a7ht:gAEs/tCgBrnv3BqdY9URmaRCoMGPGtGf
Malware Config
Extracted
icedid
2564056318
sheaffic.org
memphase.com
vulcate.com
sheaffic.com
eurobable.com
-
auth_var
1
-
url_path
/index.php
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
IcedID Second Stage Loader 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d40ab1b49cd288ceb9e916ee64799ae1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d40ab1b49cd288ceb9e916ee64799ae1_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
20KB