Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 01:39
General
-
Target
JaffaCakes118_fca52291ed5eedb8ca96f25575854ae4ab79150cef40e72c60e1073a0e3ad180.dll
-
Size
490KB
-
MD5
d060453f47dbbddac0a8849082104187
-
SHA1
b870cb985b697a20606763165a559fa02b306708
-
SHA256
fca52291ed5eedb8ca96f25575854ae4ab79150cef40e72c60e1073a0e3ad180
-
SHA512
2958b9e86a1ac3b4b86077a599e948d12bc61dc6e50d8a2a9e5bf028b7f864f6f7d2d8400e8f4e32966a62593af00c368217fa2f66b93902082551fdedf29c90
-
SSDEEP
12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR1:knmj6xK1y3Ik6TZGR1
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
3467965077
C2
firenicatrible.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Icedid family
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fca52291ed5eedb8ca96f25575854ae4ab79150cef40e72c60e1073a0e3ad180.dll1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
56KB