icedid | ad91cc0f5f38735a2a88df59382b93919a0f3112cae592f4a0477e20ef414469

Analysis

max time kernel
91s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 00:02

Target

2c59a019fc71eaa1c00220cb7a19bfde_JaffaCakes118.dll
Size

214KB
MD5

2c59a019fc71eaa1c00220cb7a19bfde
SHA1

870082e0c3a2a9a06ef9dce655f500d02ed0790c
SHA256

ad91cc0f5f38735a2a88df59382b93919a0f3112cae592f4a0477e20ef414469
SHA512

aeb2dba7cc52356eba30fd146bfe6ffe370b23f293913bd1fdf430aa0d8ec1cb4f289c06e2d6399a7ba7eb9eaa2142b8b5cbcdff1458719086097329d8ff002d
SSDEEP

6144:54+U6OuUhTIXJnxeecA9ikbl4yB6ETGzM0y:a+U6OZeh9cA/lV6ETGw0y

Score

10^/10

Family

icedid

ldrshekel.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/2444-1-0x0000000074B50000-0x0000000074BE7000-memory.dmp	IcedidFirstLoader

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4112 2444 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4112	2444	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 540 wrote to memory of 2444	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 2444	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 2444	540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c59a019fc71eaa1c00220cb7a19bfde_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c59a019fc71eaa1c00220cb7a19bfde_JaffaCakes118.dll,#1
2⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 596
3⤵
- Program crash
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2444 -ip 2444
1⤵
PID:3196

memory/2444-0-0x0000000074B84000-0x0000000074B88000-memory.dmp

Filesize
16KB

Download
memory/2444-1-0x0000000074B50000-0x0000000074BE7000-memory.dmp

Filesize
604KB

Download
memory/2444-2-0x0000000074B84000-0x0000000074B88000-memory.dmp

Filesize
16KB

Download
memory/2444-3-0x0000000074B50000-0x0000000074BE4000-memory.dmp

Filesize
592KB

Download