icedid | 17a4f04a2ea0f9934bd25d734010ee2b9559f1639fc3dc4ad1311916f8bd2dc9

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 22:13

Target
JaffaCakes118_17a4f04a2ea0f9934bd25d734010ee2b9559f1639fc3dc4ad1311916f8bd2dc9.dll
Size 490KB
Sample241223-148caasrhs
SHA256 17a4f04a2ea0f9934bd25d734010ee2b9559f1639fc3dc4ad1311916f8bd2dc9
MD5 4baae90742cca7e36691138aacf72d7a
SHA1 6b72cefd6f9cfc2a7c4e363340382e471be745e5
SHA512 5f00cb83621a9b32110dd8d9474433a724c91677c2647f461e202c73a66ecf2c284328a85622cde2606d107eef24e4d4662fcc1b0091652ce2f1c7e88ea5210d
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRH:knmj6xK1y3Ik6TZGRH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2160	regsvr32.exe
2160	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_17a4f04a2ea0f9934bd25d734010ee2b9559f1639fc3dc4ad1311916f8bd2dc9.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160

memory/2160-0-0x0000000001020000-0x000000000102E000-memory.dmp

Download

memory/2160-1-0x0000000001020000-0x000000000102E000-memory.dmp

Download