icedid | 20dd0fcf8526a4c1e0cdb7924c5fe4dacbaf9de503476a799b30b1de012ef2fb

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 06:01 UTC

Target

JaffaCakes118_20dd0fcf8526a4c1e0cdb7924c5fe4dacbaf9de503476a799b30b1de012ef2fb.dll
Size

490KB
MD5

2bc725fd0d33bc18c9b24ef2decf7949
SHA1

1cc6db3cb60a3fdc1a0d95c1002d069da4479032
SHA256

20dd0fcf8526a4c1e0cdb7924c5fe4dacbaf9de503476a799b30b1de012ef2fb
SHA512

fb1df159b6adf54775a24fa150b1a77b6340870d120f5a69efcdb4cec94243952bc2d9c425352285a171d12d5a73ed05e38407fe680ffbfe437bf9e23789fad6
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR1:knmj6xK1y3Ik6TZGR1

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2328	regsvr32.exe
2328	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20dd0fcf8526a4c1e0cdb7924c5fe4dacbaf9de503476a799b30b1de012ef2fb.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2328

No results found

memory/2328-0-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/2328-1-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download