icedid | 63243346edb5b8173bad445c479aba970d76e9c09df8c32d055c482a8215ee59

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 21:38 UTC

Target

JaffaCakes118_63243346edb5b8173bad445c479aba970d76e9c09df8c32d055c482a8215ee59.dll
Size

490KB
MD5

5896ecd5bf05dab0e5b4983b11c7f62e
SHA1

26fcd1f6b381d01a04391305cf3000df9bf303e1
SHA256

63243346edb5b8173bad445c479aba970d76e9c09df8c32d055c482a8215ee59
SHA512

40088ed5e2af0d9cef640023b4df0a29d6babfe6db6329b3464198f20b12482947dd0a43649a33b3d9b49f67cf4e807b26e1fda7f4116e2a65192c411f1f4a92
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRb:knmj6xK1y3Ik6TZGRb

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	regsvr32.exe
1692	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63243346edb5b8173bad445c479aba970d76e9c09df8c32d055c482a8215ee59.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692

No results found

memory/1692-0-0x0000000001D80000-0x0000000001D8E000-memory.dmp

Filesize
56KB

Download
memory/1692-1-0x0000000001D80000-0x0000000001D8E000-memory.dmp

Filesize
56KB

Download