Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-09-2024 15:06
Static task
static1
Behavioral task
behavioral1
Sample
e2c487a87a5be69af4a86f82317fa941_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
e2c487a87a5be69af4a86f82317fa941_JaffaCakes118.dll
-
Size
267KB
-
MD5
e2c487a87a5be69af4a86f82317fa941
-
SHA1
046ce6a92833ac623769c4bee4e6e656c8d40f22
-
SHA256
1fc02c2bbb954f1fbfee85140618025b23c6d3a8a793b28909139a43e68e6adb
-
SHA512
a0e0002591a1f972f0e443c4586c8b25539a5e2a3f439e6534fa88bb967e38d6e158709d9b292b37bd3a527e7055196537ebd937eb9fc88e66feeed84e8acada
-
SSDEEP
3072:WKCvsQ1ZkyvvaVj5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCSvytr7UtkiBvPLiAOg3kaeXV6y
Malware Config
Extracted
icedid
wertigohol.click
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2408-2-0x00000000746A0000-0x0000000074BF5000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 38 IoCs
Processes:
rundll32.exeflow pid process 3 2408 rundll32.exe 4 2408 rundll32.exe 6 2408 rundll32.exe 7 2408 rundll32.exe 10 2408 rundll32.exe 11 2408 rundll32.exe 13 2408 rundll32.exe 14 2408 rundll32.exe 16 2408 rundll32.exe 17 2408 rundll32.exe 18 2408 rundll32.exe 19 2408 rundll32.exe 21 2408 rundll32.exe 22 2408 rundll32.exe 24 2408 rundll32.exe 25 2408 rundll32.exe 27 2408 rundll32.exe 28 2408 rundll32.exe 30 2408 rundll32.exe 31 2408 rundll32.exe 32 2408 rundll32.exe 33 2408 rundll32.exe 35 2408 rundll32.exe 36 2408 rundll32.exe 38 2408 rundll32.exe 39 2408 rundll32.exe 41 2408 rundll32.exe 42 2408 rundll32.exe 44 2408 rundll32.exe 45 2408 rundll32.exe 46 2408 rundll32.exe 47 2408 rundll32.exe 49 2408 rundll32.exe 50 2408 rundll32.exe 52 2408 rundll32.exe 53 2408 rundll32.exe 55 2408 rundll32.exe 56 2408 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2256 wrote to memory of 2408 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 2408 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 2408 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 2408 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 2408 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 2408 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 2408 2256 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2c487a87a5be69af4a86f82317fa941_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2c487a87a5be69af4a86f82317fa941_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2408