Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 03:15
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7e4e32f77af1d4708abbe6951d867cfb236967e698107851524cd5b47ac17e7e.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7e4e32f77af1d4708abbe6951d867cfb236967e698107851524cd5b47ac17e7e.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7e4e32f77af1d4708abbe6951d867cfb236967e698107851524cd5b47ac17e7e.dll
-
Size
490KB
-
MD5
3c326ce9f039ac8ec47626b6b7bba346
-
SHA1
7d0017380d175d4d734273d5f91fdca42c1faf45
-
SHA256
7e4e32f77af1d4708abbe6951d867cfb236967e698107851524cd5b47ac17e7e
-
SHA512
ea72eecd1e9c02184bb435c17acd692269216f17ae84806df1cc23d32daf01be12456475375f816b19ebf80e58d7e5a71dcccec595e1797f746a99f00d7b32e1
-
SSDEEP
12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRU:knmj6xK1y3Ik6TZGRU
Malware Config
Extracted
icedid
3467965077
firenicatrible.com
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request85.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestfirenicatrible.comIN AResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestfirenicatrible.comIN AResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestfirenicatrible.comIN AResponse
-
73 B 147 B 1 1
DNS Request
217.106.137.52.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
85.49.80.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
22.160.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
64 B 137 B 1 1
DNS Request
firenicatrible.com
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
64 B 137 B 1 1
DNS Request
firenicatrible.com
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
-
64 B 137 B 1 1
DNS Request
firenicatrible.com
-