icedid | 5aa2d00964d30e9840a48387f14177c3c5344ded92463e13d9c618937580ac3c

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 22:29 UTC

Target

JaffaCakes118_5aa2d00964d30e9840a48387f14177c3c5344ded92463e13d9c618937580ac3c.dll
Size

490KB
MD5

606742db3480194cb1cb05a9085edcc6
SHA1

872b1095d005b6e68d90deb64978b11b1ecd91ef
SHA256

5aa2d00964d30e9840a48387f14177c3c5344ded92463e13d9c618937580ac3c
SHA512

1ea096f3f2b94df8ccce02d5513da3ddd00ef982954b41ea47b8736dd22c82fae1eb46e3af6c46e10f48b4457244466b5ab6e1fc0f0b0cfc6e988f3e28e9eaa3
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR2:knmj6xK1y3Ik6TZGR2

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2856	regsvr32.exe
2856	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5aa2d00964d30e9840a48387f14177c3c5344ded92463e13d9c618937580ac3c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856

No results found

memory/2856-0-0x00000000002F0000-0x00000000002FE000-memory.dmp

Filesize
56KB

Download
memory/2856-1-0x00000000002F0000-0x00000000002FE000-memory.dmp

Filesize
56KB

Download