icedid | 91c5d42edf779dabe0716974c5c103de5625dc4ef31b963d186d52185c2a2991

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 02:31

Target

JaffaCakes118_91c5d42edf779dabe0716974c5c103de5625dc4ef31b963d186d52185c2a2991.dll
Size

490KB
MD5

b8a2930e9f35869759ab288b7d7f10cc
SHA1

75b3924362b213df4a613c878089baaf26fb93bc
SHA256

91c5d42edf779dabe0716974c5c103de5625dc4ef31b963d186d52185c2a2991
SHA512

f463eeae7cc8a0a245a575406ba61773b70e20258a3e2eb98a3ef994b400685358f7da3c545b3dabefadde810a138f5e7f1e1e0b170571f1c70d550a5bca7599
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR/:knmj6xK1y3Ik6TZGR/

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
384	regsvr32.exe
384	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91c5d42edf779dabe0716974c5c103de5625dc4ef31b963d186d52185c2a2991.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:384

memory/384-0-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download
memory/384-1-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download