icedid | 1ec583d715d3b5d766242d37ceba2b5b3028a908345d41fd1b6e846aef15c3c2

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/12/2024, 01:10

Target

JaffaCakes118_1ec583d715d3b5d766242d37ceba2b5b3028a908345d41fd1b6e846aef15c3c2.dll
Size

490KB
MD5

767d77ac62a9cd6f1cbe81bf08dd571f
SHA1

ba6175efc2b45ed5048197b3c27de9e7f3b4e9f3
SHA256

1ec583d715d3b5d766242d37ceba2b5b3028a908345d41fd1b6e846aef15c3c2
SHA512

3c0ab933fdfc822746621508f2ffdcd35ffb1ce56383632cb65c5674c39db9a112522e7b920f1838ea88db5e504dad0dd7b774f233e956b6f295dbb7513b4aea
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRm:knmj6xK1y3Ik6TZGRm

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	regsvr32.exe
2796	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1ec583d715d3b5d766242d37ceba2b5b3028a908345d41fd1b6e846aef15c3c2.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796

memory/2796-0-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download
memory/2796-1-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download