icedid | d327953700d36a0963bf4452797663d794621c58963ee1b585d201397aa1d980

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 03:04

Target
JaffaCakes118_d327953700d36a0963bf4452797663d794621c58963ee1b585d201397aa1d980.dll
Size 490KB
Sample241224-dklmvazpgt
SHA256 d327953700d36a0963bf4452797663d794621c58963ee1b585d201397aa1d980
MD5 7243f5463ce1b5ac5044a2579fbb275a
SHA1 cbcb97d87e5d8e0aa8d788581a6dd376bdd5167f
SHA512 8b2039d90d0e651dc3d1062066e0e163ec12380bfa7cc86f1c6fedd2e5b80a79e74ed605d01fd1cb112a80874762537816d33c7914a029f57acc6b62b0063564
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRC:knmj6xK1y3Ik6TZGRC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3396	regsvr32.exe
3396	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d327953700d36a0963bf4452797663d794621c58963ee1b585d201397aa1d980.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3396

memory/3396-0-0x0000000001180000-0x000000000118E000-memory.dmp

Download

memory/3396-1-0x0000000001180000-0x000000000118E000-memory.dmp

Download