icedid | 0e689834621807e27005096a274712a5243053bb41e3434fd517ad0c1beda76a

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 09:46 UTC

Target

JaffaCakes118_0e689834621807e27005096a274712a5243053bb41e3434fd517ad0c1beda76a.dll
Size

490KB
MD5

ddd769864f02cc10b5314f9d97c1568e
SHA1

8fa5b9b7442c945639727c85468aeef5839d7409
SHA256

0e689834621807e27005096a274712a5243053bb41e3434fd517ad0c1beda76a
SHA512

770145bbf2db8d46aa5388ccdd33e1d3aac80aa3d52c0d789dc5ee32fc3f5beb62dd74253c95246e6f157fe3ce5b8cdf35158f27a193cffcb8458e229b4f68f5
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRk:knmj6xK1y3Ik6TZGRk

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2568	regsvr32.exe
2568	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e689834621807e27005096a274712a5243053bb41e3434fd517ad0c1beda76a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2568

No results found

memory/2568-0-0x0000000001D80000-0x0000000001D8E000-memory.dmp

Filesize
56KB

Download
memory/2568-1-0x0000000001D80000-0x0000000001D8E000-memory.dmp

Filesize
56KB

Download