icedid | 430e7064ca916f6c81ecda91d8ea400def7d51a5099385818cf1336e56dc169b

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 03:03

Target
JaffaCakes118_430e7064ca916f6c81ecda91d8ea400def7d51a5099385818cf1336e56dc169b.dll
Size 490KB
Sample241224-dj1els1jam
SHA256 430e7064ca916f6c81ecda91d8ea400def7d51a5099385818cf1336e56dc169b
MD5 92edd39ffb3adf2096cbb32edd826bc4
SHA1 241b4600c834902b59df3cc24503ac62e217728a
SHA512 810f055a609e564908bd984c5347c6ce3deb2a74d1e8a556e2060d54402114329a6261c5e832ee8ad8c2c9e695480dade20a9f3afd45134f87a74363954dbd0b
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRD:knmj6xK1y3Ik6TZGRD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4548	regsvr32.exe
4548	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_430e7064ca916f6c81ecda91d8ea400def7d51a5099385818cf1336e56dc169b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4548

memory/4548-0-0x0000000001110000-0x000000000111E000-memory.dmp

Download

memory/4548-1-0x0000000001110000-0x000000000111E000-memory.dmp

Download