icedid | ed7d1eb3deeafa4fd99a430dee84fb2e8e00e529cf9e2c2243ce5f3cf43596f1

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 10:23

Target
JaffaCakes118_ed7d1eb3deeafa4fd99a430dee84fb2e8e00e529cf9e2c2243ce5f3cf43596f1.dll
Size 490KB
Sample241224-mesnmsvlfv
SHA256 ed7d1eb3deeafa4fd99a430dee84fb2e8e00e529cf9e2c2243ce5f3cf43596f1
MD5 1397203c6c8dc367677e1a557b9971fa
SHA1 b72d74ca1188370646538b8b2e69a15dd92cafbe
SHA512 f6e8f670f05bf8d142bf9f2cea8a378771795c40075ba94e7b6ecc068ccf739389751e70d01199dba91dd28e6084046046e250b7135e4d5080cdbfbc0903f1ff
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRS:knmj6xK1y3Ik6TZGRS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3156	regsvr32.exe
3156	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed7d1eb3deeafa4fd99a430dee84fb2e8e00e529cf9e2c2243ce5f3cf43596f1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3156

memory/3156-0-0x00000000029D0000-0x00000000029DE000-memory.dmp

Download

memory/3156-1-0x00000000029D0000-0x00000000029DE000-memory.dmp

Download