icedid | 1177c85b7e3f2eeec4402736550a05f3140f0d70a29921c87f9232deb04a3377

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 21:07

Target

JaffaCakes118_1177c85b7e3f2eeec4402736550a05f3140f0d70a29921c87f9232deb04a3377.dll
Size

490KB
MD5

3d5a029921c314cd7c75c9cd2ca2e68b
SHA1

52d59e1863fa6a0265a752758853afbbe99787fa
SHA256

1177c85b7e3f2eeec4402736550a05f3140f0d70a29921c87f9232deb04a3377
SHA512

127d08a7f90a3e795fec1a9b2f995d2557bf632fd8af475da15a3e014d66fa15b59d741b4f5d336581ec66a73e27d267359c22ae04928949d207c7290d2d1c11
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRr:knmj6xK1y3Ik6TZGRr

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	regsvr32.exe
3000	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1177c85b7e3f2eeec4402736550a05f3140f0d70a29921c87f9232deb04a3377.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000

memory/3000-0-0x00000000004F0000-0x00000000004FE000-memory.dmp

Filesize
56KB

Download
memory/3000-1-0x00000000004F0000-0x00000000004FE000-memory.dmp

Filesize
56KB

Download