Analysis

  • max time kernel
    121s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 03:21

General

  • Target

    JaffaCakes118_ed6a7f2c4eb0f6a2610065bda54ccc1be968d73a93b72a056217da0e681a9a08.dll

  • Size

    42KB

  • MD5

    d638ffe91eb0e858ec15b6656f005eef

  • SHA1

    374d6d5950359ae580242af692b01ef8490146fb

  • SHA256

    ed6a7f2c4eb0f6a2610065bda54ccc1be968d73a93b72a056217da0e681a9a08

  • SHA512

    94b7b904005ce6e45b2357b43ae2f5a189bcd9938340c377dd54eb824dbea325a4e4ed04dda243bd3a08e0b4aef77712b5eae80c7d39495a626ba2103ae336e0

  • SSDEEP

    768:atj+ZsANytyuDqIeJ6PLuCO2qQlgTuorrOw6tOl3RT0bxUsTWQ2fy:WjFCPpcPLuCO20aoQM3RgVUFq

Malware Config

Extracted

Family

icedid

Campaign

4238614428

C2

immotransfer.top

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Icedid family
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed6a7f2c4eb0f6a2610065bda54ccc1be968d73a93b72a056217da0e681a9a08.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3876-1-0x0000000002220000-0x000000000227B000-memory.dmp

    Filesize

    364KB