icedid | b14d05d76e73216123b815b0a2afa5c1c93d1cf1a7409080a940ad42faf6ca94

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 00:09

Target
JaffaCakes118_b14d05d76e73216123b815b0a2afa5c1c93d1cf1a7409080a940ad42faf6ca94.dll
Size 490KB
Sample241224-afrfrawmfl
SHA256 b14d05d76e73216123b815b0a2afa5c1c93d1cf1a7409080a940ad42faf6ca94
MD5 e86e1ab1f4717581f78dc57be821244e
SHA1 c3b2a8f9fb31b7f83225ff66363a29125e705779
SHA512 0f8fbf95f4996cc6e69c763b68c9013706d280d69bd82f9a853b9b13fd55124e0e9a178847df6a97b305b3648987cb30d52f161f033b5acadfc0d53738e38039
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRp:knmj6xK1y3Ik6TZGRp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
64	regsvr32.exe
64	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b14d05d76e73216123b815b0a2afa5c1c93d1cf1a7409080a940ad42faf6ca94.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:64

memory/64-0-0x0000000002AC0000-0x0000000002ACE000-memory.dmp

Download

memory/64-1-0x0000000002AC0000-0x0000000002ACE000-memory.dmp

Download