icedid | 576879697de3ac96aa20bd918b79cff20365293c9ae2a5c03d392e078120575a

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 00:04

Target

JaffaCakes118_576879697de3ac96aa20bd918b79cff20365293c9ae2a5c03d392e078120575a.dll
Size

490KB
MD5

19adbf37bf570313eaa99b549db9d6d1
SHA1

1f3b7cafb20b574c09e6a8146a24d1baeebe75d4
SHA256

576879697de3ac96aa20bd918b79cff20365293c9ae2a5c03d392e078120575a
SHA512

68ce1a63e0063a7ab793d494bd4409f37f75518c5c11e230d121bbd64e7985819a44c6c97b7d2e7f6558895d5ab1dd34720badd2dffa75780ab706a6ef5c5fa2
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR0:knmj6xK1y3Ik6TZGR0

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	regsvr32.exe
1016	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_576879697de3ac96aa20bd918b79cff20365293c9ae2a5c03d392e078120575a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1016

memory/1016-0-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download
memory/1016-1-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download