icedid | 0d3a18ae0018427bbf053669e07bcc3cd9bc248b04a6dd0c082694d20818b56c

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 22:06

Target

b055bc5918d93625b5c13562e5e3b424_JaffaCakes118.dll
Size

120KB
MD5

b055bc5918d93625b5c13562e5e3b424
SHA1

a13a347668ee77ae34d8f903f61988e17e82b68e
SHA256

0d3a18ae0018427bbf053669e07bcc3cd9bc248b04a6dd0c082694d20818b56c
SHA512

22036de96a6611ea7db705629f7ff519963fc950456a0a3cc99280adbf76f03846c568565ec8e3edf8bd736e4c53c75ca83abbc84491411b0ccb8d8ee4abe375
SSDEEP

3072:za+dUDMZJjkzSzh25YohAUwr3XnsOOujmZOtl:wMZSzSzhA1rwDXnhZCSl

Score

10^/10

Family

icedid

loadwe4.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 4 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2092-12-0x0000000000140000-0x0000000000148000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2092-8-0x00000000003B0000-0x00000000003B6000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2092-4-0x00000000001E0000-0x00000000001E8000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2092-0-0x0000000000150000-0x000000000015A000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2080 wrote to memory of 2092	2080	regsvr32.exe	regsvr32.exe
PID 2080 wrote to memory of 2092	2080	regsvr32.exe	regsvr32.exe
PID 2080 wrote to memory of 2092	2080	regsvr32.exe	regsvr32.exe
PID 2080 wrote to memory of 2092	2080	regsvr32.exe	regsvr32.exe
PID 2080 wrote to memory of 2092	2080	regsvr32.exe	regsvr32.exe
PID 2080 wrote to memory of 2092	2080	regsvr32.exe	regsvr32.exe
PID 2080 wrote to memory of 2092	2080	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b055bc5918d93625b5c13562e5e3b424_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b055bc5918d93625b5c13562e5e3b424_JaffaCakes118.dll
  2⤵
  PID:2092

memory/2092-12-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/2092-8-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/2092-4-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/2092-0-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download