Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 08:07
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4c65504188cef1278d3e63658836a33ad6779665d33b68f7a32ac57ba59056f6.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4c65504188cef1278d3e63658836a33ad6779665d33b68f7a32ac57ba59056f6.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_4c65504188cef1278d3e63658836a33ad6779665d33b68f7a32ac57ba59056f6.dll
-
Size
490KB
-
MD5
98d272eaf91a95942308eecb9a7f7b88
-
SHA1
58c082bf545a68e77839d49ff15b16f1572a68ce
-
SHA256
4c65504188cef1278d3e63658836a33ad6779665d33b68f7a32ac57ba59056f6
-
SHA512
cdf2579f6b932fda82b7f5c9f4e21cbdfd52592272118121c094cb9c610e20da101e0e2db95dddeae9b1c6ddf622b7dbd9694fb180b90abcf0a67e7e8f8bb7e9
-
SSDEEP
12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRh:knmj6xK1y3Ik6TZGRh
Malware Config
Extracted
icedid
3467965077
firenicatrible.com
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request180.129.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestfirenicatrible.comIN AResponse
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request24.139.73.23.in-addr.arpaIN PTRResponse24.139.73.23.in-addr.arpaIN PTRa23-73-139-24deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestfirenicatrible.comIN AResponse
-
Remote address:8.8.8.8:53Requestfirenicatrible.comIN AResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
180.129.81.91.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
64 B 137 B 1 1
DNS Request
firenicatrible.com
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
24.139.73.23.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
64 B 137 B 1 1
DNS Request
firenicatrible.com
-
64 B 137 B 1 1
DNS Request
firenicatrible.com