icedid | d6aa034d935a5cc17de138bff63ffce7593f29ad267ebb8cb536e280822b928c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 10:21

Target
JaffaCakes118_d6aa034d935a5cc17de138bff63ffce7593f29ad267ebb8cb536e280822b928c.dll
Size 490KB
Sample241224-md4phsvndj
SHA256 d6aa034d935a5cc17de138bff63ffce7593f29ad267ebb8cb536e280822b928c
MD5 b0944da047fffc8ca88f8b7099a021be
SHA1 dac2cf914dd8b29d62356247240fe2e8da033b33
SHA512 d266631f88e1b6e12f93a74034f58134fd622a83b85158d1cba6b5f95691836553a4518d6c63536c698c3dae1bc1d706cbc1f63bcb30602d2f35e746386c4b64
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRz:knmj6xK1y3Ik6TZGRz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	regsvr32.exe
2520	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6aa034d935a5cc17de138bff63ffce7593f29ad267ebb8cb536e280822b928c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520

memory/2520-0-0x0000000001FF0000-0x0000000001FFE000-memory.dmp

Download

memory/2520-1-0x0000000001FF0000-0x0000000001FFE000-memory.dmp

Download