icedid | 85ee9c6b6b6cc4402355965527f9cc8638c3e536aa86eb27c592868336f6fe38

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 00:16

Target

ec4b8927826bcef3a5c4ab9e827e172c_JaffaCakes118.dll
Size

191KB
MD5

ec4b8927826bcef3a5c4ab9e827e172c
SHA1

c5adeff83369fb337fc898df309a03de25b7aaee
SHA256

85ee9c6b6b6cc4402355965527f9cc8638c3e536aa86eb27c592868336f6fe38
SHA512

d4921112e143811e874f98a3e4184d1b227fb81546c5eb1fae4af9885b010ea1db634a62213e3f9e8a0c7c2af8272d3ccdeab62708a897fae22d468204bf5b85
SSDEEP

3072:ccYZrnyQL8toZWf5phHqhqEd7ckhk1vd2g/ahdbNagw4At0wMtU9hCEf8//DBQ8:0Q6Wf5Whv7fMvwbNXtYLMG8

Score

10^/10

Family

icedid

ldrpolka.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/2168-0-0x0000000074760000-0x00000000747F9000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2168	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2168	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2168	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2168	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2168	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2168	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2168	1692	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec4b8927826bcef3a5c4ab9e827e172c_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ec4b8927826bcef3a5c4ab9e827e172c_JaffaCakes118.dll
  2⤵
  PID:2168

memory/2168-0-0x0000000074760000-0x00000000747F9000-memory.dmp

Filesize
612KB

Download