Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2024 03:25

General

  • Target

    JaffaCakes118_41a8013a81ec29167d05aea56f377e56d0ee970c7ce9f3902dc0b2e34e18ed9f.dll

  • Size

    490KB

  • MD5

    b194e16afe12f4d8080f360e72ad4da2

  • SHA1

    b988f51b647cee366d7b68e55c3a06b1ce540b3a

  • SHA256

    41a8013a81ec29167d05aea56f377e56d0ee970c7ce9f3902dc0b2e34e18ed9f

  • SHA512

    706dd1ddc66c921d23017a65914da5fb201fcd2e84bcf97ca299aa0b7d5b6e77079e28da790a679350acd1bd7f0b147148061da6f3e455bd9b014311d4d85f85

  • SSDEEP

    12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR9:knmj6xK1y3Ik6TZGR9

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Icedid family
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_41a8013a81ec29167d05aea56f377e56d0ee970c7ce9f3902dc0b2e34e18ed9f.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1740-0-0x00000000002C0000-0x00000000002CE000-memory.dmp

    Filesize

    56KB

  • memory/1740-1-0x00000000002C0000-0x00000000002CE000-memory.dmp

    Filesize

    56KB