icedid | d27d77b586f3a6b2808839b9cb082da7cf2c4fcf90fbe66b5615613b27ea2163

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 17:49 UTC

Target

JaffaCakes118_d27d77b586f3a6b2808839b9cb082da7cf2c4fcf90fbe66b5615613b27ea2163.dll
Size

490KB
MD5

409cd447e06e395d69cafb51922f69f0
SHA1

497ed2c58b164dd13df644f4554a277d82d47d19
SHA256

d27d77b586f3a6b2808839b9cb082da7cf2c4fcf90fbe66b5615613b27ea2163
SHA512

eb8be23247c238f9c08c2c2c1a960005bea4d964c078bb4a79881740a2e2511b21e38100e0bef4ef882bc1b199e818c4f89a4ec8b5967538fad9472ae6b92f38
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRx:knmj6xK1y3Ik6TZGRx

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	regsvr32.exe
2976	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d27d77b586f3a6b2808839b9cb082da7cf2c4fcf90fbe66b5615613b27ea2163.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976

No results found

memory/2976-0-0x0000000001D00000-0x0000000001D0E000-memory.dmp

Filesize
56KB

Download
memory/2976-1-0x0000000001D00000-0x0000000001D0E000-memory.dmp

Filesize
56KB

Download