icedid | 4e6d853d0cb249b2a236c4d1f186647c7afbb9d669f1646337ee5d056dcd7a2f

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 03:23

Target
JaffaCakes118_4e6d853d0cb249b2a236c4d1f186647c7afbb9d669f1646337ee5d056dcd7a2f.dll
Size 490KB
Sample241224-dxth8a1lgn
SHA256 4e6d853d0cb249b2a236c4d1f186647c7afbb9d669f1646337ee5d056dcd7a2f
MD5 769d5c101d393187f00932a20f685867
SHA1 01f5f464ef502b355056256b507a6d4f8497dbb7
SHA512 6f8445c5b217cf39850628819d6eec7c250dd288a59697638344b176a99a85c75769b9ec64c35e8fcd9a952602f30f260fbe09373edb638f5cce8e458a2a2c15
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRL:knmj6xK1y3Ik6TZGRL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2936	regsvr32.exe
2936	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e6d853d0cb249b2a236c4d1f186647c7afbb9d669f1646337ee5d056dcd7a2f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2936

memory/2936-0-0x00000000023E0000-0x00000000023EE000-memory.dmp

Download

memory/2936-1-0x00000000023E0000-0x00000000023EE000-memory.dmp

Download