icedid | 8b903e1c022c6b8179d8b66587c0eba6224c6c1896fe60c778286b9058bcdf96

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 18:25 UTC

Target

JaffaCakes118_8b903e1c022c6b8179d8b66587c0eba6224c6c1896fe60c778286b9058bcdf96.dll
Size

490KB
MD5

3d3be3a5d7f2a5648b9bfe459c4ce139
SHA1

8aaac7d58094b1acc657da7b9669144f455eee84
SHA256

8b903e1c022c6b8179d8b66587c0eba6224c6c1896fe60c778286b9058bcdf96
SHA512

2abd21280f4bba2c62190712d04564366b29db701f287b35317e5c9b0311286025444089f28f74cc3c030a65062a2e4765ca38d0f3c1a4aa42909121b1133a69
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR+:knmj6xK1y3Ik6TZGR+

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1508	regsvr32.exe
1508	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8b903e1c022c6b8179d8b66587c0eba6224c6c1896fe60c778286b9058bcdf96.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508

No results found

memory/1508-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/1508-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download