icedid | 00782776b1838f5905b79e8beeee1c705536758aa5255e48e7c7b8414b34c143

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 10:06

Target
JaffaCakes118_00782776b1838f5905b79e8beeee1c705536758aa5255e48e7c7b8414b34c143.dll
Size 490KB
Sample241224-l46fcsvlfl
SHA256 00782776b1838f5905b79e8beeee1c705536758aa5255e48e7c7b8414b34c143
MD5 5b2b608e7581b3b24a66563e8c69bc49
SHA1 f946e696254da463ef88f27b864cebe5b2693881
SHA512 62716ac2de0e3c4fac7167efea9728e0640a5e5206819c674aeadd16f0438def4346169d2d4ee759ca68504c83f4bcb8fd0d3234325c436fcbb1b0e8a601ff87
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRa:knmj6xK1y3Ik6TZGRa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	regsvr32.exe
3444	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_00782776b1838f5905b79e8beeee1c705536758aa5255e48e7c7b8414b34c143.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3444

memory/3444-0-0x0000000002CB0000-0x0000000002CBE000-memory.dmp

Download

memory/3444-1-0x0000000002CB0000-0x0000000002CBE000-memory.dmp

Download