icedid | dba67ec7a7ce016c238893260e21737a6738f611e3bb7cef80d2bb47ddd7d140

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 06:04

Target

b20a7461e5651d526026554d5f32246f_JaffaCakes118.dll
Size

120KB
MD5

b20a7461e5651d526026554d5f32246f
SHA1

338467315fd2f0a0be362246eafa40a06a5a2f05
SHA256

dba67ec7a7ce016c238893260e21737a6738f611e3bb7cef80d2bb47ddd7d140
SHA512

4f3b108877f75c4bcaba3c08293d88c7bdf59aca7858cfbcbd38e2b726898cdd98aa60efab802cb337863c56f90a6b1344f31773aece48ce525a0da7095b1d1a
SSDEEP

3072:za+dUDMZJjkzSzh25YohAUwr3XnsOOujmZOt/:wMZSzSzhA1rwDXnhZCS/

Score

10^/10

Family

icedid

loadwe4.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 4 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2052-0-0x00000000001A0000-0x00000000001AA000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2052-12-0x0000000000180000-0x0000000000188000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2052-8-0x0000000000250000-0x0000000000256000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2052-4-0x00000000001F0000-0x00000000001F8000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2560 wrote to memory of 2052	2560	regsvr32.exe	regsvr32.exe
PID 2560 wrote to memory of 2052	2560	regsvr32.exe	regsvr32.exe
PID 2560 wrote to memory of 2052	2560	regsvr32.exe	regsvr32.exe
PID 2560 wrote to memory of 2052	2560	regsvr32.exe	regsvr32.exe
PID 2560 wrote to memory of 2052	2560	regsvr32.exe	regsvr32.exe
PID 2560 wrote to memory of 2052	2560	regsvr32.exe	regsvr32.exe
PID 2560 wrote to memory of 2052	2560	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b20a7461e5651d526026554d5f32246f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b20a7461e5651d526026554d5f32246f_JaffaCakes118.dll
  2⤵
  PID:2052

memory/2052-0-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/2052-12-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/2052-8-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2052-4-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download