icedid | 24403b138019711bc44b8915e52fe7a801381bf9fcab22f6f86f4691e4e0baff

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 18:18 UTC

Target

JaffaCakes118_24403b138019711bc44b8915e52fe7a801381bf9fcab22f6f86f4691e4e0baff.dll
Size

490KB
MD5

ce605ce18bac96a67e2379329c8c741d
SHA1

fa7e5a9bc5f136d1d9d64f10210750a18a969d50
SHA256

24403b138019711bc44b8915e52fe7a801381bf9fcab22f6f86f4691e4e0baff
SHA512

a58e09c2095e868014a63361e6ce8b3494d2018f04e016274a23bf5bc0df11ee95d04d7536cc4f4e36d8f9186a1e62f1968f24bf71a3bedabb87b59dd0f067af
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR+:knmj6xK1y3Ik6TZGR+

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	regsvr32.exe
2992	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_24403b138019711bc44b8915e52fe7a801381bf9fcab22f6f86f4691e4e0baff.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992

No results found

memory/2992-0-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/2992-1-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download