Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 05:23

General

  • Target

    JaffaCakes118_79cd17db702c2e90a7eb24aa7f005108c91872b60bd3f4d2894320f05e93d537.dll

  • Size

    490KB

  • MD5

    380ae3adec4ff7421b481167279ccd92

  • SHA1

    7437e319fbc88c2a1dfe005bc04b6032fbf07d42

  • SHA256

    79cd17db702c2e90a7eb24aa7f005108c91872b60bd3f4d2894320f05e93d537

  • SHA512

    a219f38d5153c16081cae106dbeeb650a8b8e068fe7e7726011aec870ef7fa2ee721c8c4377c019408ee71b65cd42a29dcc6a8d8ee3a4dab1cdde4d3673f4752

  • SSDEEP

    12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR/:knmj6xK1y3Ik6TZGR/

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Icedid family
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79cd17db702c2e90a7eb24aa7f005108c91872b60bd3f4d2894320f05e93d537.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3128-0-0x0000000000B80000-0x0000000000B8E000-memory.dmp

    Filesize

    56KB

  • memory/3128-1-0x0000000000B80000-0x0000000000B8E000-memory.dmp

    Filesize

    56KB