icedid | e1f5474d52c837fa8343ca57001d323261ff5b793e2d51981f68b2ac8b6bed77

Analysis

max time kernel
143s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 03:55

Target

JaffaCakes118_e1f5474d52c837fa8343ca57001d323261ff5b793e2d51981f68b2ac8b6bed77.dll
Size

490KB
MD5

21ff80150e51da6a6905533316051569
SHA1

77b1e7424eb4095238601c7d6082384f1e893e28
SHA256

e1f5474d52c837fa8343ca57001d323261ff5b793e2d51981f68b2ac8b6bed77
SHA512

37614f91951a3ddf6011c46e71664654ab97c4108e670bc8633f45708029dd1b68ed6d45683bed5a1cd15d5d5061018253ff76ff1ed5f8b02a8d5fa11b56ea5b
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRA:knmj6xK1y3Ik6TZGRA

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	regsvr32.exe
3000	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e1f5474d52c837fa8343ca57001d323261ff5b793e2d51981f68b2ac8b6bed77.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000

memory/3000-0-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download
memory/3000-1-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download