Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-09-2024 20:20
Static task
static1
Behavioral task
behavioral1
Sample
f46f78ca95597fffeff734068e6ba681_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
f46f78ca95597fffeff734068e6ba681_JaffaCakes118.dll
-
Size
267KB
-
MD5
f46f78ca95597fffeff734068e6ba681
-
SHA1
5abe992df37b86efe5f7a1e019f101ee135a8a76
-
SHA256
887a73dd182c064135d8451dc7a1c04b9dd19c89e1ec012b5dd22bac52116e6a
-
SHA512
11ae1d7f2d4abd01866c09e44a028dcc2902a0ec5365239681fef066f52b8b09059abfeabd3e1d2039f6149f7dd0adb1c344d195c15c4a95f6f63c599e5eb6cd
-
SSDEEP
3072:WKCvsQ1ZkyvvaVC5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCJvytr7UtkiBvPLiAOg3kaeXV6y
Malware Config
Extracted
icedid
wertigohol.click
Signatures
-
IcedID First Stage Loader 2 IoCs
resource yara_rule behavioral1/memory/2864-1-0x0000000074310000-0x0000000074865000-memory.dmp IcedidFirstLoader behavioral1/memory/2864-2-0x0000000074310000-0x0000000074865000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 36 IoCs
flow pid Process 3 2864 rundll32.exe 4 2864 rundll32.exe 6 2864 rundll32.exe 7 2864 rundll32.exe 10 2864 rundll32.exe 11 2864 rundll32.exe 13 2864 rundll32.exe 14 2864 rundll32.exe 16 2864 rundll32.exe 17 2864 rundll32.exe 18 2864 rundll32.exe 19 2864 rundll32.exe 21 2864 rundll32.exe 22 2864 rundll32.exe 24 2864 rundll32.exe 25 2864 rundll32.exe 27 2864 rundll32.exe 28 2864 rundll32.exe 30 2864 rundll32.exe 31 2864 rundll32.exe 32 2864 rundll32.exe 33 2864 rundll32.exe 35 2864 rundll32.exe 36 2864 rundll32.exe 38 2864 rundll32.exe 39 2864 rundll32.exe 41 2864 rundll32.exe 42 2864 rundll32.exe 44 2864 rundll32.exe 45 2864 rundll32.exe 47 2864 rundll32.exe 48 2864 rundll32.exe 50 2864 rundll32.exe 51 2864 rundll32.exe 53 2864 rundll32.exe 54 2864 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2864 2328 rundll32.exe 31 PID 2328 wrote to memory of 2864 2328 rundll32.exe 31 PID 2328 wrote to memory of 2864 2328 rundll32.exe 31 PID 2328 wrote to memory of 2864 2328 rundll32.exe 31 PID 2328 wrote to memory of 2864 2328 rundll32.exe 31 PID 2328 wrote to memory of 2864 2328 rundll32.exe 31 PID 2328 wrote to memory of 2864 2328 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f46f78ca95597fffeff734068e6ba681_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f46f78ca95597fffeff734068e6ba681_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2864
-