icedid | c0a53237d08523669743722a5e13a9de3f7bc04a96ba2ee5d5c39faa25bf0721

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 18:14 UTC

Target

JaffaCakes118_c0a53237d08523669743722a5e13a9de3f7bc04a96ba2ee5d5c39faa25bf0721.dll
Size

490KB
MD5

3a4bcab31691926ef0cab0b14780a94b
SHA1

5bfdb3a977918bd85fba9a0e407e5e67d0326e70
SHA256

c0a53237d08523669743722a5e13a9de3f7bc04a96ba2ee5d5c39faa25bf0721
SHA512

e25cb2e19e739621daea706118513f74c00c723edabfaa5d0932e127b673e7387359239652d35ebb47b7a9e5c1a8d3292b1076e61647e115a84cabc7a18d9a8e
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRd:knmj6xK1y3Ik6TZGRd

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2944	regsvr32.exe
2944	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c0a53237d08523669743722a5e13a9de3f7bc04a96ba2ee5d5c39faa25bf0721.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2944

No results found

memory/2944-0-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download
memory/2944-1-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download