icedid | 11539edb949b4ee55973e8857ce1273dcbbc8f418c8fa4800d004b3597950c3d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 23:30

Target
JaffaCakes118_11539edb949b4ee55973e8857ce1273dcbbc8f418c8fa4800d004b3597950c3d.dll
Size 490KB
Sample241223-3hlx9svmds
SHA256 11539edb949b4ee55973e8857ce1273dcbbc8f418c8fa4800d004b3597950c3d
MD5 3c0f3cc745d6ae4927312b25e77a854d
SHA1 834aa9cbb14d6b253f93ccb4ba0c3d0467f83f0b
SHA512 381ac9aac59773dc5f573fd71a890e87d640bd9128931237eb7386562cc42bbe2026e993627e0d64b4a7e6c1a77fe73441e1df2526cbcd7d697d961b16d3dc16
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRs:knmj6xK1y3Ik6TZGRs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	regsvr32.exe
3184	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11539edb949b4ee55973e8857ce1273dcbbc8f418c8fa4800d004b3597950c3d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3184

memory/3184-0-0x0000000002680000-0x000000000268E000-memory.dmp

Download

memory/3184-1-0x0000000002680000-0x000000000268E000-memory.dmp

Download