Analysis
-
max time kernel
145s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-09-2024 21:19
General
-
Target
dd11fb3c9d76df104dd54cab9eabc403_JaffaCakes118.exe
-
Size
228KB
-
MD5
dd11fb3c9d76df104dd54cab9eabc403
-
SHA1
63f7f1b2281f82bec711ab3dc490abde5a24f288
-
SHA256
86747b573f7f2f20d75754e073411b56e93515eba22cf5c4307a24059e662b16
-
SHA512
1532121e4d03955f5a4c33bd622a5da09357b37448ea923dacf12ca98e77af822de1dc3af3cd773f23d175c9b1cf5c42e914b01dbd150528d62e46b738f01949
-
SSDEEP
3072:DvbniW198DEYusGG2dIcnnhIm3fbk/1WJC6qidEIiCu8o3Bo84/X3wrbiW14:DJX8DAsGGDchISj95+CuOX/
Score
10/10
Malware Config
Extracted
Family
icedid
Botnet
3940132575
C2
besitxavier.best
nazifestivo.best
Attributes
-
auth_var
2
-
url_path
/audio/
Extracted
Family
icedid
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
IcedID Second Stage Loader 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd11fb3c9d76df104dd54cab9eabc403_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dd11fb3c9d76df104dd54cab9eabc403_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
20KB