icedid | 2251930fd721e04e00b78d39fd2ce60913f68d1400615b6a08ef6075338de562

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 03:16

Target
JaffaCakes118_2251930fd721e04e00b78d39fd2ce60913f68d1400615b6a08ef6075338de562.dll
Size 490KB
Sample241224-dsv69a1khm
SHA256 2251930fd721e04e00b78d39fd2ce60913f68d1400615b6a08ef6075338de562
MD5 c2791e5de1e3f533e053e5ce03b3b98e
SHA1 769988dea4038c65da843c586ebba75fc385b8b2
SHA512 d8f3a08691e05f2b06b101c95624ae11e78023033fafc7c824d6fdcf49fde3c8f7e9207bfcbb8c5e55b3eab020d172eddb377aa1d94947887911a744a04ae830
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRh:knmj6xK1y3Ik6TZGRh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2808	regsvr32.exe
2808	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2251930fd721e04e00b78d39fd2ce60913f68d1400615b6a08ef6075338de562.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2808

memory/2808-0-0x0000000002B10000-0x0000000002B1E000-memory.dmp

Download

memory/2808-1-0x0000000002B10000-0x0000000002B1E000-memory.dmp

Download