icedid | cadb2af5498f354aeec9d84df80751d54f01bc2c59fed7a15ab88e78d941e6ed

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 01:22 UTC

Target

JaffaCakes118_cadb2af5498f354aeec9d84df80751d54f01bc2c59fed7a15ab88e78d941e6ed.dll
Size

490KB
MD5

ff30f55909fb7db354b02e7db70a6adb
SHA1

683cbb00c9e74f00645f2675b4aef18f01b886c2
SHA256

cadb2af5498f354aeec9d84df80751d54f01bc2c59fed7a15ab88e78d941e6ed
SHA512

41aa386845821adab2f4ec8477a2ce1d379b5a9537e712dc6da4f872756880104ecf92a43370937201da46b7bc2fbb0d1c6eff50adc45796d9a1f4f4fb20d228
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRy:knmj6xK1y3Ik6TZGRy

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
548	regsvr32.exe
548	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cadb2af5498f354aeec9d84df80751d54f01bc2c59fed7a15ab88e78d941e6ed.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:548

No results found

memory/548-0-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download
memory/548-1-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download