icedid | 21249ce24600b1feac26a2a9883f3c6de299681a924be281630bc3869f0f4044

Analysis

max time kernel
127s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 00:13

Target

1d101557dc7b95085ba874ac4bdb38dc_JaffaCakes118.dll
Size

3.0MB
MD5

1d101557dc7b95085ba874ac4bdb38dc
SHA1

d92e541c707cb8825860ba8f3bf801b06fb5b0c2
SHA256

21249ce24600b1feac26a2a9883f3c6de299681a924be281630bc3869f0f4044
SHA512

31dffd6ab386d1e6df37d9aa0333c2d16b3e154d2557bf1d8bb39ae313285ae4fc463a4ed92b8a86f39ff4a624d35dfc83c1b7567e634a96e29b47347e5d6e2f
SSDEEP

49152:dqGB2KwBl+dyMzac4d12JVb4ZwDI0A3dQIOOtxE5/8ojWVVidT7gU9Y7xV:FB1wBlYykZ4L2JVkWQ3REJjWS7M7xV

Score

10^/10

Family

icedid

Campaign

620514333

oskolko.uno

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2432-0-0x000007FEF6570000-0x000007FEF69E0000-memory.dmp	IcedidFirstLoader

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2432-0-0x000007FEF6570000-0x000007FEF69E0000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2432 regsvr32.exe
2432 regsvr32.exe

pid	process
2432	regsvr32.exe
2432	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1d101557dc7b95085ba874ac4bdb38dc_JaffaCakes118.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432

memory/2432-0-0x000007FEF6570000-0x000007FEF69E0000-memory.dmp

Filesize
4.4MB

Download