icedid | 0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 14:09

Target

9e754bbe3e8d27ade46b544ca82d68b2_JaffaCakes118.dll
Size

224KB
MD5

9e754bbe3e8d27ade46b544ca82d68b2
SHA1

7a82992b50aefe5599c159bb069687250d7b00ab
SHA256

0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb
SHA512

6af4c48eb1c975b08c3a5fd7553e45aa064a39116442772fc3479a942a41b88125e434784a16c78917661c377d000251c820330d8de35cf4d8b3c27cac60e41e
SSDEEP

3072:U6VYA6I0oElwS9ciW+eM+ppv2LHFKp6+7bUSrtB0J3B1rq46vqDyPIKpPLq/M:UWxXElK+Spv2owSlt6JR1YSDuImq/M

Score

10^/10

Family

icedid

loadberlin.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/2200-2-0x0000000074FE0000-0x0000000075024000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 14 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4540 wrote to memory of 2200	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 2200	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 2200	4540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e754bbe3e8d27ade46b544ca82d68b2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e754bbe3e8d27ade46b544ca82d68b2_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2200

memory/2200-2-0x0000000074FE0000-0x0000000075024000-memory.dmp

Filesize
272KB

Download
memory/2200-1-0x0000000075017000-0x000000007501B000-memory.dmp

Filesize
16KB

Download