icedid | 0c0ea4260894784e7cea05ab47825cf4aa6e79c4238b906e27212616d0b8a20c

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 20:03 UTC

Target

JaffaCakes118_0c0ea4260894784e7cea05ab47825cf4aa6e79c4238b906e27212616d0b8a20c.dll
Size

490KB
MD5

7d14aced3d38fbf0289e647b8e2f74e4
SHA1

d20c3475631533d634673f60a093dcaa85c18510
SHA256

0c0ea4260894784e7cea05ab47825cf4aa6e79c4238b906e27212616d0b8a20c
SHA512

80d39005b4e8a5d486bf1953b1fc2e0f5d27e64a3e7261380d0bb846dff61635a68ab1a13a928dcccc9abed7cd88815bdbb9da6f61576d8cd70e32c8794f06c7
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRo:knmj6xK1y3Ik6TZGRo

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2364	regsvr32.exe
2364	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c0ea4260894784e7cea05ab47825cf4aa6e79c4238b906e27212616d0b8a20c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364

No results found

memory/2364-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/2364-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download