icedid | 8d703fda91f50f38d7d967322168d98a83357ca1aed71a8299fe7006813f92a7

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 22:06

Target
JaffaCakes118_8d703fda91f50f38d7d967322168d98a83357ca1aed71a8299fe7006813f92a7.dll
Size 490KB
Sample241223-11cffasqev
SHA256 8d703fda91f50f38d7d967322168d98a83357ca1aed71a8299fe7006813f92a7
MD5 09656b6cc837b886312bbb79400f493c
SHA1 acfe8a24a71f1f13ce1418acadee27cee580cc16
SHA512 82cdfa364912ebc000c52427bb44978ad1cab5cbb4d12a06ba93948b2f53690bce9d6b907f6ae3577df5d9d170d01c949add10ed481e14af14761fa9bb4a84c6
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRo:knmj6xK1y3Ik6TZGRo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5080	regsvr32.exe
5080	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8d703fda91f50f38d7d967322168d98a83357ca1aed71a8299fe7006813f92a7.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080

memory/5080-0-0x0000000002220000-0x000000000222E000-memory.dmp

Download

memory/5080-1-0x0000000002220000-0x000000000222E000-memory.dmp

Download