Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 08:10
General
-
Target
JaffaCakes118_e4a2dfcbc0eb23b4b726ef3af4890b62819f43a1fa61e3fe153b1a136dc3f4a9.dll
-
Size
490KB
-
MD5
2b22f8c526da9d98cf37c629d25d5c26
-
SHA1
0204c05d1546505622a2c3c35a1c117158e9f97e
-
SHA256
e4a2dfcbc0eb23b4b726ef3af4890b62819f43a1fa61e3fe153b1a136dc3f4a9
-
SHA512
c2f5aa39a3b82b3822ed5a9d38f90f8643f9893022669d0e0bf3d3af838664d6d95838255567bcb945541a2671a191fe344c891aec18caef46cd6d14d5e86aba
-
SSDEEP
12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR4:knmj6xK1y3Ik6TZGR4
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
3467965077
C2
firenicatrible.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Icedid family
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e4a2dfcbc0eb23b4b726ef3af4890b62819f43a1fa61e3fe153b1a136dc3f4a9.dll1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
56KB