Overview

overview

10

Static

static

7

191f0a5dd7...18.dll

windows7-x64

10

191f0a5dd7...18.dll

windows10-2004-x64

10

Resubmissions

28-06-2024 11:41

240628-ntldjszgmq 10

28-06-2024 06:30

240628-g9vtlayblr 10

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28-06-2024 06:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    191f0a5dd7622595d3d38decf8061c05_JaffaCakes118.dll

  • Size

    3.0MB

  • MD5

    191f0a5dd7622595d3d38decf8061c05

  • SHA1

    bded0a27fd4b759642720f8fbd4470a168f75576

  • SHA256

    e7636efbaf3e170af8f7cbc36f4c030f3df0bc89547186ddfe03e66a5c8c0b92

  • SHA512

    a1d2f5b4055c705f4e6f0394ff8b10127c8802d96e87722a34a6eaa0968d34853a9279de497d837c8b45c439e763bb2a65f4207c7e9db1a1165cbc99c96fa952

  • SSDEEP

    49152:EBKs6yFyQqn4ZvgZ3aj+wvLoK/DVcONC/LzUX0QrxwyrIrP1VRmmnsQYp:EB36Sy94y3ajroKbCDoWPRT

Score
10/10
icedid3744237144bankerloadertrojanvmprotect

Malware Config

Extracted

Family

icedid

Campaign

3744237144

C2

hommyfloppy.best

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • IcedID First Stage Loader 1 IoCs
    loader
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\191f0a5dd7622595d3d38decf8061c05_JaffaCakes118.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2328-0-0x000007FEF6120000-0x000007FEF6589000-memory.dmp
    Filesize

    4.4MB

    Download