Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22-12-2024 09:20
General
-
Target
JaffaCakes118_d71da8f0954f3189a18c6964db292c3cba55e932a7baf9d6e2b138c9aaed9f2f.dll
-
Size
490KB
-
MD5
85684b80b754d0bd06d255cc1962f030
-
SHA1
86edc70754e4e9ee2a465d67c77340c65d948960
-
SHA256
d71da8f0954f3189a18c6964db292c3cba55e932a7baf9d6e2b138c9aaed9f2f
-
SHA512
53c2b15d2eb80b61b8f5c7869b977a7ccd0dcd0e7a469cd137d59390f88188731859bc95cd34e8c3b7c08adbf99bf09f75e60263a76d33108d8c562cd6caea5a
-
SSDEEP
12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR5:knmj6xK1y3Ik6TZGR5
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
3467965077
C2
firenicatrible.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Icedid family
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d71da8f0954f3189a18c6964db292c3cba55e932a7baf9d6e2b138c9aaed9f2f.dll1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
56KB