icedid | 7c94b78d14c95b438b0af4eb93596c2f7a64d8a9a1b2c9b300f5d4c43661a9b9

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 01:40

Target

82ac29c322c3a97d6b0a0bf528f28097_JaffaCakes118.dll
Size

171KB
MD5

82ac29c322c3a97d6b0a0bf528f28097
SHA1

50d21c573262ba613796abd958b490fb6d65c407
SHA256

7c94b78d14c95b438b0af4eb93596c2f7a64d8a9a1b2c9b300f5d4c43661a9b9
SHA512

a2a48daf57cb7f48f055e5c6c38f15f81376195284ac4d10fe39f4ddecd5a1ae80f3a782fdcfce85620c2d4684140df29f20b17bba81a64dd262b2ee88a5d1f6
SSDEEP

3072:aGlF282vlhUDj+PoJFXpeZpaZARWQJ1h52iWNgdxeoRUxNGhLKgUQh0BVj:H7eyaPonp2AmRWg1h3NxqxNuLKQyBx

Score

10^/10

Family

icedid

ldrpeso.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2740-0-0x00000000753A0000-0x0000000075422000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2740-2-0x00000000753A0000-0x0000000075422000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 34 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1964 wrote to memory of 2740	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 2740	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 2740	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 2740	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 2740	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 2740	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 2740	1964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82ac29c322c3a97d6b0a0bf528f28097_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\82ac29c322c3a97d6b0a0bf528f28097_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2740

memory/2740-1-0x00000000753CA000-0x00000000753CE000-memory.dmp

Filesize
16KB

Download
memory/2740-0-0x00000000753A0000-0x0000000075422000-memory.dmp

Filesize
520KB

Download
memory/2740-2-0x00000000753A0000-0x0000000075422000-memory.dmp

Filesize
520KB

Download