icedid | b2b401ebd751e1d88566937eefbf08a65642405fc851c8d2aff6e03252bc04c9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 22:27

Target
JaffaCakes118_b2b401ebd751e1d88566937eefbf08a65642405fc851c8d2aff6e03252bc04c9.dll
Size 490KB
Sample241223-2da5jatlbs
SHA256 b2b401ebd751e1d88566937eefbf08a65642405fc851c8d2aff6e03252bc04c9
MD5 c64bd40c2f06a7ce01d10ccea262a07c
SHA1 b89fd6366ba049f902f420b04299cae3ada237b1
SHA512 bf7f4a59208d8d0e067e43b34faf84271d854f8d41a7110990621c2fa92997107c4232bfa09e3d6b56a9f45d78e6a8431bdcd2d31236e0485c08dd28f0ed3133
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRN:knmj6xK1y3Ik6TZGRN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3844	regsvr32.exe
3844	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2b401ebd751e1d88566937eefbf08a65642405fc851c8d2aff6e03252bc04c9.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3844

memory/3844-0-0x00000000014C0000-0x00000000014CE000-memory.dmp

Download

memory/3844-1-0x00000000014C0000-0x00000000014CE000-memory.dmp

Download