Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 21:45

General

  • Target

    JaffaCakes118_dfb4b025f650df6c0a26104e888923d7cdead2d830ac46b521a252233e199b32.dll

  • Size

    490KB

  • MD5

    12f98d3428e96778f96dffb48d84a7b4

  • SHA1

    510441defc4048a13619496fcb3f9018f73d78fe

  • SHA256

    dfb4b025f650df6c0a26104e888923d7cdead2d830ac46b521a252233e199b32

  • SHA512

    754798199906a84e6bb3636a2cbaf4878ef4d840fefee23b03a5d4d69611a107b11ace003f290d57fe51605e6e2f3c60f13ff2e0010ce91477e87ebff952c51c

  • SSDEEP

    12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRM:knmj6xK1y3Ik6TZGRM

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Icedid family
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dfb4b025f650df6c0a26104e888923d7cdead2d830ac46b521a252233e199b32.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1348-0-0x0000000002D60000-0x0000000002D6E000-memory.dmp

    Filesize

    56KB

  • memory/1348-1-0x0000000002D60000-0x0000000002D6E000-memory.dmp

    Filesize

    56KB