icedid | b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 16:02

Target

0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe
Size

382KB
MD5

0ef3890b051c62c04435a5ab8cb15ec2
SHA1

c810007de17fe76f2fca134d0a1003c790a616d9
SHA256

b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b
SHA512

e56f43ae5a2c19f1e5b74ab5018821257aac3a5d94daa2c656d6181d33250acfed04f48d7bd678ab946d7eb48204760cb488a24f3503919b13ea7438bd1f2bc0
SSDEEP

6144:N3GXaEkS6acHhDbYIur4J4Zn4HSMz6gCz3FGIcAolpgVHMe4IuKKew8O/CTq:N4aW4uMz6DwAUOVHMe4938C

Score

10^/10

Family

icedid

wloppyload.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/1100-3-0x00000000021E0000-0x00000000021E6000-memory.dmp	IcedidFirstLoader
behavioral2/memory/1100-6-0x00000000021D0000-0x00000000021D3000-memory.dmp	IcedidFirstLoader

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe

pid process

1100 0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe
1100 0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe

pid	process
1100	0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe
1100	0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ef3890b051c62c04435a5ab8cb15ec2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1100

memory/1100-3-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/1100-6-0x00000000021D0000-0x00000000021D3000-memory.dmp

Filesize
12KB

Download
memory/1100-7-0x00000000021C0000-0x00000000021C8000-memory.dmp

Filesize
32KB

Download