icedid | ad91cc0f5f38735a2a88df59382b93919a0f3112cae592f4a0477e20ef414469

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 00:02

Target

2c59a019fc71eaa1c00220cb7a19bfde_JaffaCakes118.dll
Size

214KB
MD5

2c59a019fc71eaa1c00220cb7a19bfde
SHA1

870082e0c3a2a9a06ef9dce655f500d02ed0790c
SHA256

ad91cc0f5f38735a2a88df59382b93919a0f3112cae592f4a0477e20ef414469
SHA512

aeb2dba7cc52356eba30fd146bfe6ffe370b23f293913bd1fdf430aa0d8ec1cb4f289c06e2d6399a7ba7eb9eaa2142b8b5cbcdff1458719086097329d8ff002d
SSDEEP

6144:54+U6OuUhTIXJnxeecA9ikbl4yB6ETGzM0y:a+U6OZeh9cA/lV6ETGw0y

Score

10^/10

Family

icedid

ldrshekel.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/2720-1-0x0000000074E80000-0x0000000074F17000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 30 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28
PID 2460 wrote to memory of 2720	2460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c59a019fc71eaa1c00220cb7a19bfde_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c59a019fc71eaa1c00220cb7a19bfde_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2720

memory/2720-1-0x0000000074E80000-0x0000000074F17000-memory.dmp

Filesize
604KB

Download
memory/2720-0-0x0000000074EB4000-0x0000000074EB8000-memory.dmp

Filesize
16KB

Download