icedid | 85ee9c6b6b6cc4402355965527f9cc8638c3e536aa86eb27c592868336f6fe38

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 00:16

Target

ec4b8927826bcef3a5c4ab9e827e172c_JaffaCakes118.dll
Size

191KB
MD5

ec4b8927826bcef3a5c4ab9e827e172c
SHA1

c5adeff83369fb337fc898df309a03de25b7aaee
SHA256

85ee9c6b6b6cc4402355965527f9cc8638c3e536aa86eb27c592868336f6fe38
SHA512

d4921112e143811e874f98a3e4184d1b227fb81546c5eb1fae4af9885b010ea1db634a62213e3f9e8a0c7c2af8272d3ccdeab62708a897fae22d468204bf5b85
SSDEEP

3072:ccYZrnyQL8toZWf5phHqhqEd7ckhk1vd2g/ahdbNagw4At0wMtU9hCEf8//DBQ8:0Q6Wf5Whv7fMvwbNXtYLMG8

Score

10^/10

Family

icedid

ldrpolka.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/228-0-0x0000000074FD0000-0x0000000075069000-memory.dmp	IcedidFirstLoader
behavioral2/memory/228-2-0x0000000074FD0000-0x0000000075069000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 228	2368	regsvr32.exe	90
PID 2368 wrote to memory of 228	2368	regsvr32.exe	90
PID 2368 wrote to memory of 228	2368	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec4b8927826bcef3a5c4ab9e827e172c_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ec4b8927826bcef3a5c4ab9e827e172c_JaffaCakes118.dll
  2⤵
  PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4516

memory/228-0-0x0000000074FD0000-0x0000000075069000-memory.dmp

Filesize
612KB

Download
memory/228-1-0x0000000001310000-0x0000000001311000-memory.dmp

Filesize
4KB

Download
memory/228-2-0x0000000074FD0000-0x0000000075069000-memory.dmp

Filesize
612KB

Download
memory/228-4-0x0000000001310000-0x0000000001311000-memory.dmp

Filesize
4KB

Download