Analysis
-
max time kernel
96s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 11:41
Behavioral task
behavioral1
Sample
191f0a5dd7622595d3d38decf8061c05_JaffaCakes118.dll
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
191f0a5dd7622595d3d38decf8061c05_JaffaCakes118.dll
-
Size
3.0MB
-
MD5
191f0a5dd7622595d3d38decf8061c05
-
SHA1
bded0a27fd4b759642720f8fbd4470a168f75576
-
SHA256
e7636efbaf3e170af8f7cbc36f4c030f3df0bc89547186ddfe03e66a5c8c0b92
-
SHA512
a1d2f5b4055c705f4e6f0394ff8b10127c8802d96e87722a34a6eaa0968d34853a9279de497d837c8b45c439e763bb2a65f4207c7e9db1a1165cbc99c96fa952
-
SSDEEP
49152:EBKs6yFyQqn4ZvgZ3aj+wvLoK/DVcONC/LzUX0QrxwyrIrP1VRmmnsQYp:EB36Sy94y3ajroKbCDoWPRT
Malware Config
Extracted
Family
icedid
Campaign
3744237144
C2
hommyfloppy.best
Signatures
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4508-0-0x00007FF841FC0000-0x00007FF842429000-memory.dmp IcedidFirstLoader -
Processes:
resource yara_rule behavioral2/memory/4508-0-0x00007FF841FC0000-0x00007FF842429000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4508 regsvr32.exe 4508 regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4508-0-0x00007FF841FC0000-0x00007FF842429000-memory.dmpFilesize
4.4MB