icedid | 530001e38045813d7276694c428b64b4dc5a15b77f2b3cc757f64b8d34bcf815

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 07:02

Target

04a1c81b1bb3b37e86d2a43aef5ff880_JaffaCakes118.dll
Size

211KB
MD5

04a1c81b1bb3b37e86d2a43aef5ff880
SHA1

1daf08516a85baa7abf5d2d51b4db965808cf632
SHA256

530001e38045813d7276694c428b64b4dc5a15b77f2b3cc757f64b8d34bcf815
SHA512

881034af36cff20176df88d5c9b91badd4119ec25c24046e46899309d2b260603cf9a00da3e1dc19a9fb5b1f5766da178ed5efa7c9bd3e8daa1a820258e5811f
SSDEEP

6144:6ZLwRyyWMa3NIBkL6LDW8dTZdw702edvxiuYOO6umz4N:6ZLwRyyHadIBkLIi8dTL2SvguYOO1mkN

Score

10^/10

Family

icedid

ldrstar.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/1956-0-0x0000000075110000-0x000000007519C000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 36 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2300 wrote to memory of 1956	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 1956	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 1956	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 1956	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 1956	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 1956	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 1956	2300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04a1c81b1bb3b37e86d2a43aef5ff880_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04a1c81b1bb3b37e86d2a43aef5ff880_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:1956

memory/1956-1-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1956-0-0x0000000075110000-0x000000007519C000-memory.dmp

Filesize
560KB

Download