icedid | 03a538cf6dd52df4584d7cdd254409c2f108340d98000c989390a4fed331ced0

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 03:00

Target
JaffaCakes118_03a538cf6dd52df4584d7cdd254409c2f108340d98000c989390a4fed331ced0.dll
Size 490KB
Sample241224-dhhs6szrep
SHA256 03a538cf6dd52df4584d7cdd254409c2f108340d98000c989390a4fed331ced0
MD5 22fbeb0ae13aa1c28b6e8dd8a8bf32b8
SHA1 b4b83d4b2e64d215fe7507f27a737e3d97bc0157
SHA512 c0c1d64009a13cf8c57f2b4170db0ee85959be4602e672ac99a68a8e5c7905a8e0be7f07b02317c135e58ca7a39502082c37c7ac1772bb03251e564aea0a248b
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR0B:knmj6xK1y3Ik6TZGR0B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1100	regsvr32.exe
1100	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03a538cf6dd52df4584d7cdd254409c2f108340d98000c989390a4fed331ced0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1100

memory/1100-0-0x0000000002A30000-0x0000000002A3E000-memory.dmp

Download

memory/1100-1-0x0000000002A30000-0x0000000002A3E000-memory.dmp

Download