icedid | 5eaae899b23b97f66586d03667159f55e0a33c22ebea1e0c7e7bdc3c8e9e2b8a

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23/12/2024, 23:28

Target

JaffaCakes118_5eaae899b23b97f66586d03667159f55e0a33c22ebea1e0c7e7bdc3c8e9e2b8a.dll
Size

490KB
MD5

aabfa9d70b1059f80c02108adc13b44c
SHA1

a712a74b77ae2fe388217394e478821b1a911f1c
SHA256

5eaae899b23b97f66586d03667159f55e0a33c22ebea1e0c7e7bdc3c8e9e2b8a
SHA512

5b13c62369b20fb9475191f73d06ea8a4520dc6758375e13b9beb91b856e6748ecc41ec03b6ce6f610e677ed028c17847de011fc032bd7973ed76870a0f3499d
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRx:knmj6xK1y3Ik6TZGRx

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1972	regsvr32.exe
1972	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5eaae899b23b97f66586d03667159f55e0a33c22ebea1e0c7e7bdc3c8e9e2b8a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1972

memory/1972-0-0x00000000005D0000-0x00000000005DE000-memory.dmp

Filesize
56KB

Download
memory/1972-1-0x00000000005D0000-0x00000000005DE000-memory.dmp

Filesize
56KB

Download