icedid | e79695e0b0ee0ad04d510c569df3f736950c81b29de2186b448b9224af5b5728

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 09:12 UTC

Target

JaffaCakes118_e79695e0b0ee0ad04d510c569df3f736950c81b29de2186b448b9224af5b5728.dll
Size

490KB
MD5

f2cc679cf12e01874574a8dcd157f4a5
SHA1

db28e5e777b3983de0ca9fb0252e0071c27ff70a
SHA256

e79695e0b0ee0ad04d510c569df3f736950c81b29de2186b448b9224af5b5728
SHA512

857c09879d1e7f517115287ab4c75db9efd1f81de6f31893131f72a8eaee4402fd0404f40407cea51cca07643eab41bae99eec3d60fc3c4f13030e6d6130c809
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRL:knmj6xK1y3Ik6TZGRL

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1836	regsvr32.exe
1836	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e79695e0b0ee0ad04d510c569df3f736950c81b29de2186b448b9224af5b5728.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836

No results found

memory/1836-0-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download
memory/1836-1-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download