icedid | 67142cda96e90155f7e4f2a119d96cd0548ddc7fd252dba9c437503373f4eb5c

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 11:46

Target
JaffaCakes118_67142cda96e90155f7e4f2a119d96cd0548ddc7fd252dba9c437503373f4eb5c.dll
Size 490KB
Sample241224-nxh3laxjdl
SHA256 67142cda96e90155f7e4f2a119d96cd0548ddc7fd252dba9c437503373f4eb5c
MD5 611298f6287c794c0b3b35804746184e
SHA1 32b139ceba50d522b9e753a875d462149d8c5a47
SHA512 c55077935e80479487e7d5081e6a6824f30408ead80958bedc942842e838bcbb69248cac3a694e8e467848e0357de3ecd76104ea18e86603c6b9c8e1a76e9efb
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRX:knmj6xK1y3Ik6TZGRX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
32	regsvr32.exe
32	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_67142cda96e90155f7e4f2a119d96cd0548ddc7fd252dba9c437503373f4eb5c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:32

memory/32-0-0x0000000002790000-0x000000000279E000-memory.dmp

Download

memory/32-1-0x0000000002790000-0x000000000279E000-memory.dmp

Download