icedid | d5b7bd2ec129e5b39f70ab51f7f385710ee1359cad029898021f4e654fd59683

Analysis

max time kernel
96s
max time network
41s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23/12/2024, 15:39 UTC

Target

JaffaCakes118_d5b7bd2ec129e5b39f70ab51f7f385710ee1359cad029898021f4e654fd59683.dll
Size

490KB
MD5

b610b6523db4a8d6af0e9dbb9ce5b0c7
SHA1

9c91501e0cc9fc70219707c88dc8961b77dcc672
SHA256

d5b7bd2ec129e5b39f70ab51f7f385710ee1359cad029898021f4e654fd59683
SHA512

e80653b7dab4e189e7f829c474f72ffc6c884e3990bda13203f0ab8dae0771aec8ce05a14e92c423594657a84e2876374317431c6464bd736627a6689001c2cd
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRW:knmj6xK1y3Ik6TZGRW

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2720	regsvr32.exe
2720	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d5b7bd2ec129e5b39f70ab51f7f385710ee1359cad029898021f4e654fd59683.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720

No results found

memory/2720-0-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/2720-1-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download