icedid | 31f1db7b49be5af0ebed475a761c06a923dd49018a2bfc48f4e54d3b29946fe6

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 19:04

Target

JaffaCakes118_31f1db7b49be5af0ebed475a761c06a923dd49018a2bfc48f4e54d3b29946fe6.dll
Size

490KB
MD5

7ecb293762c67449b9ef5cbf13d8cc0c
SHA1

d2b5751a6e7ee8c80acb6ee28a1606bf56a48638
SHA256

31f1db7b49be5af0ebed475a761c06a923dd49018a2bfc48f4e54d3b29946fe6
SHA512

5100f33560857ff90b8ded71db0e6a090e92aa0539d6d59241f606e96c0374f824dad6f70b78d400b94a9dc21138eb30475353d947aa7fe7304a92687d78ee97
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRQ:knmj6xK1y3Ik6TZGRQ

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	regsvr32.exe
1016	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31f1db7b49be5af0ebed475a761c06a923dd49018a2bfc48f4e54d3b29946fe6.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1016

memory/1016-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/1016-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download