icedid | ef1d1a110707e116618ed1a6c59279cb2f5fcfc1adb78a882833727c46014e94

Analysis

max time kernel
141s
max time network
21s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 04:17

Target

JaffaCakes118_ef1d1a110707e116618ed1a6c59279cb2f5fcfc1adb78a882833727c46014e94.dll
Size

490KB
MD5

f54d6911563f4a25e260637eea9a3555
SHA1

57ef4b3e1480ecbb088eaf5dc8dfe843d45a0e35
SHA256

ef1d1a110707e116618ed1a6c59279cb2f5fcfc1adb78a882833727c46014e94
SHA512

d84bb7d708dd9b888318d004dc28c9adc76f1bf5b8cbb6f90f875756302201f4e74b6b629bec81b84c258716461a6df42c06874f7ebbcced15feee55bbcd8bd2
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRA:knmj6xK1y3Ik6TZGRA

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	regsvr32.exe
2004	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ef1d1a110707e116618ed1a6c59279cb2f5fcfc1adb78a882833727c46014e94.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2004

memory/2004-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/2004-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download