icedid | 9f91888c3e2ac231cdb72b8aa6eac25fb0c507909a7d95263307ba435ac28674

Analysis

max time kernel
141s
max time network
22s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 04:01

Target

JaffaCakes118_9f91888c3e2ac231cdb72b8aa6eac25fb0c507909a7d95263307ba435ac28674.dll
Size

490KB
MD5

72d0127b4c91edc65538858463bbbddb
SHA1

022d2383001cfae6acab586e18ef47ddeb6cf563
SHA256

9f91888c3e2ac231cdb72b8aa6eac25fb0c507909a7d95263307ba435ac28674
SHA512

c58093740f292a45945e01944302bcd75baf382b75c9a4d64d79a55e7389961adf009431c506c3427685b3b7b11483ef774e6b2eb51e870447882727448c2d64
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR6:knmj6xK1y3Ik6TZGR6

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	regsvr32.exe
2004	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f91888c3e2ac231cdb72b8aa6eac25fb0c507909a7d95263307ba435ac28674.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2004

memory/2004-0-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/2004-1-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download