icedid | 25e1673795cff79237c40425f7219693cad0964db25e7781708269c1821a8b12

Analysis

max time kernel
141s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 11:48

Target
JaffaCakes118_25e1673795cff79237c40425f7219693cad0964db25e7781708269c1821a8b12.dll
Size 490KB
Sample241224-nyefsswpgs
SHA256 25e1673795cff79237c40425f7219693cad0964db25e7781708269c1821a8b12
MD5 d87138c5229c423914d4e2726e52e8d9
SHA1 afd58bdb553d48c794b2a6470870099d45906206
SHA512 41aa849c85402112396bcb43c61b5c5a871049a0286ba775cdef67fe86918c0cd1fb0d4ca685d2a5d0b4bf324367cdfe58158091df3d203ee8e4bb0b0a169cc6
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRW:knmj6xK1y3Ik6TZGRW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4972	regsvr32.exe
4972	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e1673795cff79237c40425f7219693cad0964db25e7781708269c1821a8b12.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972

memory/4972-0-0x0000000002380000-0x000000000238E000-memory.dmp

Download

memory/4972-1-0x0000000002380000-0x000000000238E000-memory.dmp

Download