icedid | 5a7f03c6dbe3e94866dbb0f706f9ce4ce86e62d3694cf8b7953caa492c4d9505

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 07:21

Target

JaffaCakes118_5a7f03c6dbe3e94866dbb0f706f9ce4ce86e62d3694cf8b7953caa492c4d9505.dll
Size

490KB
MD5

72fda8bd35fcd97a32f4bca4dfec943d
SHA1

50653bf76ed74738f2cf62d019fa805bc7af0559
SHA256

5a7f03c6dbe3e94866dbb0f706f9ce4ce86e62d3694cf8b7953caa492c4d9505
SHA512

afe7e13198d559cedda3f1d3c7a9d4ee46ea8f647176e5a8eb05fcf0e67b58cf7fe2c547c5dc0029338bb166e834197fe1cc0c679fae7ee075d22a70f6dfa840
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRQ:knmj6xK1y3Ik6TZGRQ

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1488	regsvr32.exe
1488	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5a7f03c6dbe3e94866dbb0f706f9ce4ce86e62d3694cf8b7953caa492c4d9505.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488

memory/1488-0-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/1488-1-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download