icedid | 1d1062216ad17276274c7109de5aab978c686ee2459ca19389ade74275981ab5

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 05:02

Target

JaffaCakes118_1d1062216ad17276274c7109de5aab978c686ee2459ca19389ade74275981ab5.dll
Size

490KB
MD5

1afe0a1cb5821b1b2660321debe195b3
SHA1

88434859b78ad07ef1af5922cad91ede81a918df
SHA256

1d1062216ad17276274c7109de5aab978c686ee2459ca19389ade74275981ab5
SHA512

fb7309b33a1cbe78ff9f396699b7cb8932e88016a661c0ae46852ba9443d2927d7ffc12d6043e8bfb6339cba74108cc36c12723ceab153a999f561ef3e015b4e
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRG:knmj6xK1y3Ik6TZGRG

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1992	regsvr32.exe
1992	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d1062216ad17276274c7109de5aab978c686ee2459ca19389ade74275981ab5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992

memory/1992-0-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download
memory/1992-1-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download