icedid | f668fce502476483d62350c45369ea35b4e74e52072e8e9a9016e56f49c16541

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 09:40

Target
JaffaCakes118_f668fce502476483d62350c45369ea35b4e74e52072e8e9a9016e56f49c16541.dll
Size 490KB
Sample241224-lnbk2stpgw
SHA256 f668fce502476483d62350c45369ea35b4e74e52072e8e9a9016e56f49c16541
MD5 0c2813739803b46b1cba260177d8a163
SHA1 5e75c928be587a31cd2143fd1f41012bf13fb894
SHA512 9e23b4dda66e731254260dbc6c8dd1eade1247882419c652bc98fde56e1a869cccd67f2648c7aa04942ba7d96475690a05590f3dbd444b4e9d7f9c25f1ed3ac4
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRJ:knmj6xK1y3Ik6TZGRJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2360	regsvr32.exe
2360	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f668fce502476483d62350c45369ea35b4e74e52072e8e9a9016e56f49c16541.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2360

memory/2360-0-0x00000000014C0000-0x00000000014CE000-memory.dmp

Download

memory/2360-1-0x00000000014C0000-0x00000000014CE000-memory.dmp

Download