icedid | d71da8f0954f3189a18c6964db292c3cba55e932a7baf9d6e2b138c9aaed9f2f

Analysis

max time kernel
141s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 09:20

Target

JaffaCakes118_d71da8f0954f3189a18c6964db292c3cba55e932a7baf9d6e2b138c9aaed9f2f.dll
Size

490KB
MD5

85684b80b754d0bd06d255cc1962f030
SHA1

86edc70754e4e9ee2a465d67c77340c65d948960
SHA256

d71da8f0954f3189a18c6964db292c3cba55e932a7baf9d6e2b138c9aaed9f2f
SHA512

53c2b15d2eb80b61b8f5c7869b977a7ccd0dcd0e7a469cd137d59390f88188731859bc95cd34e8c3b7c08adbf99bf09f75e60263a76d33108d8c562cd6caea5a
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR5:knmj6xK1y3Ik6TZGR5

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
404	regsvr32.exe
404	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d71da8f0954f3189a18c6964db292c3cba55e932a7baf9d6e2b138c9aaed9f2f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:404

memory/404-0-0x00000000014A0000-0x00000000014AE000-memory.dmp

Filesize
56KB

Download
memory/404-1-0x00000000014A0000-0x00000000014AE000-memory.dmp

Filesize
56KB

Download