icedid | 05158ce746669bdcbedd41e35b0dbd72e754893b189d6f5a867d42bdbcfabb95

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 19:40 UTC

Target

JaffaCakes118_05158ce746669bdcbedd41e35b0dbd72e754893b189d6f5a867d42bdbcfabb95.dll
Size

490KB
MD5

d30aa3c44cbf4e551cff983996cf85c9
SHA1

b73ae04ea72fb2eda99941d823e31f0715e5d758
SHA256

05158ce746669bdcbedd41e35b0dbd72e754893b189d6f5a867d42bdbcfabb95
SHA512

9f8e81dc0eba255e352080cdb4d0b5ecb6bd8900fdd0e65106493dfc372b2b44a87c5c79ad3f32881b028e839de702b4f95a200a0e2eaa3cd260d2d47f91dcf7
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRC:knmj6xK1y3Ik6TZGRC

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1304	regsvr32.exe
1304	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05158ce746669bdcbedd41e35b0dbd72e754893b189d6f5a867d42bdbcfabb95.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304

No results found

memory/1304-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/1304-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download