icedid | 625ee97c1953cbe83ed4233a3cbee664a0ccd15c361475852b852374411daaae

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23/12/2024, 23:20

Target

JaffaCakes118_625ee97c1953cbe83ed4233a3cbee664a0ccd15c361475852b852374411daaae.dll
Size

490KB
MD5

2c226a35dc3d178884e1ba8240a3c54d
SHA1

46ffc304aaa1fa0f6b285e427a1828f66787783a
SHA256

625ee97c1953cbe83ed4233a3cbee664a0ccd15c361475852b852374411daaae
SHA512

35eb3fd3ffe0a2b38c79164885260977e544f7e1d543e4c5bfbd9e2970122ab292cb5f68a5cf1f71a50d3715be849ef85c521c6c728cb2c85020d014274de559
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR+:knmj6xK1y3Ik6TZGR+

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2880	regsvr32.exe
2880	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_625ee97c1953cbe83ed4233a3cbee664a0ccd15c361475852b852374411daaae.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2880

memory/2880-0-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/2880-1-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download