icedid | a775e0f7a6b5f563ff5db01e6e6e4b76832408368ae8d17ffcfda561ff0c6f87

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 03:20

Target
JaffaCakes118_a775e0f7a6b5f563ff5db01e6e6e4b76832408368ae8d17ffcfda561ff0c6f87.dll
Size 490KB
Sample241224-dvv92a1jay
SHA256 a775e0f7a6b5f563ff5db01e6e6e4b76832408368ae8d17ffcfda561ff0c6f87
MD5 4bd771a8f96f37bbf86601a9b2536afe
SHA1 e1d62222bbd2968b1f4e45959045ebc5015af9d6
SHA512 d7cedc54884cc7fcd32bc753987199e225fb0af80d2f21b7671ea2596d748fc1325b3b1dd354442f5d3edf281140b51bb3de8a6e737f1c1fa32e07bd5adadf5f
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRa:knmj6xK1y3Ik6TZGRa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4452	regsvr32.exe
4452	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a775e0f7a6b5f563ff5db01e6e6e4b76832408368ae8d17ffcfda561ff0c6f87.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4452

memory/4452-0-0x0000000002820000-0x000000000282E000-memory.dmp

Download

memory/4452-1-0x0000000002820000-0x000000000282E000-memory.dmp

Download