icedid | a9974c1c037f541a4e31b62211ec9935eda5f56ef9eeb2ebbb6faf6d5706482b

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 18:20

Target

JaffaCakes118_a9974c1c037f541a4e31b62211ec9935eda5f56ef9eeb2ebbb6faf6d5706482b.dll
Size

490KB
MD5

6e6be15e47f1ec14466cc5557df7adc1
SHA1

3ea20322f5081764041e0a5b944a549df24ef941
SHA256

a9974c1c037f541a4e31b62211ec9935eda5f56ef9eeb2ebbb6faf6d5706482b
SHA512

0d094211111d454a7d50796fe02ee41e00884d6ca9f6cbf380d1f7bb2096c0f3ec3394343c1ffecf0f17c83ae99f86b5c2842a78bf991af72455b22f9f0c7e52
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRz:knmj6xK1y3Ik6TZGRz

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1600	regsvr32.exe
1600	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a9974c1c037f541a4e31b62211ec9935eda5f56ef9eeb2ebbb6faf6d5706482b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600

memory/1600-0-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download
memory/1600-1-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download