Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2024, 23:46

General

  • Target

    JaffaCakes118_4d661bb5ef48507641642f4cb8f6065811028f42166f883c03a6b403f64fd1c5.dll

  • Size

    490KB

  • MD5

    a53d7573acd0eca81474dd1b1e771de6

  • SHA1

    134368139cf911d37bd2bde78eb8a90af73082ef

  • SHA256

    4d661bb5ef48507641642f4cb8f6065811028f42166f883c03a6b403f64fd1c5

  • SHA512

    ccf8c22304e5b6346d191146a4fbf2420e820567fcbf81dd3b5658a16c80e01901d7081680f6795ee91b0b5385f22e5392a49dc397dc3aa51b63538fc7627042

  • SSDEEP

    12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRp:knmj6xK1y3Ik6TZGRp

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Icedid family
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d661bb5ef48507641642f4cb8f6065811028f42166f883c03a6b403f64fd1c5.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2440

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2440-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

          Filesize

          56KB

        • memory/2440-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

          Filesize

          56KB