icedid | aa1072c88cfed59cd12ab573c6964cb6685ff85504af55154d3aa17cf0ec148c

Analysis

max time kernel
97s
max time network
42s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 20:05 UTC

Target

JaffaCakes118_aa1072c88cfed59cd12ab573c6964cb6685ff85504af55154d3aa17cf0ec148c.dll
Size

490KB
MD5

d461d4fb77dc8eb8a2c617cbc1e8b0b3
SHA1

b60c99cfca5cface03bf1071b3f31a3dbea29c68
SHA256

aa1072c88cfed59cd12ab573c6964cb6685ff85504af55154d3aa17cf0ec148c
SHA512

97a587a133722eefe4998b8b3fc965d5f3d548059c46a36d7c665b90b8daf839e9ed6ea4276d419674d001e30351a9dc02725734305ff63b55019b34186857c7
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRC:knmj6xK1y3Ik6TZGRC

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	regsvr32.exe
1968	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aa1072c88cfed59cd12ab573c6964cb6685ff85504af55154d3aa17cf0ec148c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968

No results found

memory/1968-0-0x0000000001CE0000-0x0000000001CEE000-memory.dmp

Filesize
56KB

Download
memory/1968-1-0x0000000001CE0000-0x0000000001CEE000-memory.dmp

Filesize
56KB

Download