icedid | 1d916a05e07aa61bb84504cd7cf70e920549dde98a3eafebfde3e13d3137df24

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 12:17

Target

5f06dd5222ad5f38c294c2a605d7a1ac_JaffaCakes118.dll
Size

406KB
MD5

5f06dd5222ad5f38c294c2a605d7a1ac
SHA1

3852fff8fb9ac1a0dad431368c568e60aee40589
SHA256

1d916a05e07aa61bb84504cd7cf70e920549dde98a3eafebfde3e13d3137df24
SHA512

5b664878282689a9f898af90e59c3f3f06ce74503177874da4e58093b30c3a340870a9a94a0027d5f9f1a31b15733a73c5fc20c587a764df20f70ba94d50ec49
SSDEEP

6144:MU/OLpMfjR6vtVIgyPFiChgkX7WOMeLpebnZgUe4A29pNwz:MU/OLCfmLqPACIeoFa4A29Dwz

Score

10^/10

Family

icedid

ldrruble.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/1396-1-0x0000000075250000-0x000000007530F000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 15 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1648 wrote to memory of 1396	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1396	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1396	1648	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f06dd5222ad5f38c294c2a605d7a1ac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f06dd5222ad5f38c294c2a605d7a1ac_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1396

memory/1396-0-0x00000000752B3000-0x00000000752B7000-memory.dmp

Filesize
16KB

Download
memory/1396-1-0x0000000075250000-0x000000007530F000-memory.dmp

Filesize
764KB

Download