icedid | a4412e35c5ed7baca06d497f8b89848605102e84227fd75972ad37d3d35481c3

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 21:29

Target

JaffaCakes118_a4412e35c5ed7baca06d497f8b89848605102e84227fd75972ad37d3d35481c3.dll
Size

490KB
MD5

ab776925a0b84e22b4970bff56c1515c
SHA1

74064a4d63e7d482e88c35a583c02d3108f51746
SHA256

a4412e35c5ed7baca06d497f8b89848605102e84227fd75972ad37d3d35481c3
SHA512

e0074f7136e9d32e44e8f25e6690b955e11dfa075fe03fadc59ddaa85461f22d664753e8a10d3c04c2eb1cbe18fb75d5c69ec38a38ab684b1f46d0997f0cf6c1
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRO:knmj6xK1y3Ik6TZGRO

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
300	regsvr32.exe
300	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a4412e35c5ed7baca06d497f8b89848605102e84227fd75972ad37d3d35481c3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:300

memory/300-0-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download
memory/300-1-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download