icedid | b7b156d3d0499133da6f51e0c2e96c697e1fc12726cefeeb69e55bd286b8e54f

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23/12/2024, 16:54 UTC

Target

JaffaCakes118_b7b156d3d0499133da6f51e0c2e96c697e1fc12726cefeeb69e55bd286b8e54f.dll
Size

490KB
MD5

e09de6c6c788cafbbd24fc947eb2c8ca
SHA1

827bf5b3a6b8a2d01b8c993d5c9cad5092dd1d15
SHA256

b7b156d3d0499133da6f51e0c2e96c697e1fc12726cefeeb69e55bd286b8e54f
SHA512

48b958720e57a09776b6fb26fcd1da53df3a03b9fe33f432afa84d7695a65f430877f3ba19ba0cada74b439231a3abe50f820a04222e2d24f8a941c6298aafa0
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR+:knmj6xK1y3Ik6TZGR+

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2844	regsvr32.exe
2844	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b7b156d3d0499133da6f51e0c2e96c697e1fc12726cefeeb69e55bd286b8e54f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2844

No results found

memory/2844-0-0x0000000000570000-0x000000000057E000-memory.dmp

Filesize
56KB

Download
memory/2844-1-0x0000000000570000-0x000000000057E000-memory.dmp

Filesize
56KB

Download