icedid | 0b4948aec9691d9c5a4b19905306215aff58d36a9b9704d36e52ae5c8111fed3

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 10:49

Target
JaffaCakes118_0b4948aec9691d9c5a4b19905306215aff58d36a9b9704d36e52ae5c8111fed3.dll
Size 490KB
Sample241224-mw6a3awjer
SHA256 0b4948aec9691d9c5a4b19905306215aff58d36a9b9704d36e52ae5c8111fed3
MD5 0ce22dfc6c9fec0bd809696485e19c01
SHA1 641b7695e3d9dda4176ae41022da4f30eca83b1a
SHA512 0055cb83ff6fe40e7c755b7cefb79733230359d25eab9c045725e306dd8f37ea315c992c187a287189998a2edae5b84fa4404f52ca431cc4a9be9b061ec15e19
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR4:knmj6xK1y3Ik6TZGR4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4128	regsvr32.exe
4128	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b4948aec9691d9c5a4b19905306215aff58d36a9b9704d36e52ae5c8111fed3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4128

memory/4128-0-0x00000000012F0000-0x00000000012FE000-memory.dmp

Download

memory/4128-1-0x00000000012F0000-0x00000000012FE000-memory.dmp

Download