icedid | 0480751c56b2768711a8f34f6bfe9b43b38eeb74049522b05517be74345a44d0

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 00:47

Target
JaffaCakes118_0480751c56b2768711a8f34f6bfe9b43b38eeb74049522b05517be74345a44d0.dll
Size 490KB
Sample241225-a5py8aslht
SHA256 0480751c56b2768711a8f34f6bfe9b43b38eeb74049522b05517be74345a44d0
MD5 57c040af24cc30c4d8b0560eebc786f1
SHA1 c63aa94fa4990912202f428bb73b135024bf9d3d
SHA512 b31b960c37083a15aaf8543167ab5f2336485d5ea4ff87ebf0ed5201f34f2001a490fc4a7af9361ddc85d905d8c049604a17b3f6a086d28c2200e6f974db88ef
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRO:knmj6xK1y3Ik6TZGRO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2352	regsvr32.exe
2352	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0480751c56b2768711a8f34f6bfe9b43b38eeb74049522b05517be74345a44d0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2352

memory/2352-0-0x0000000002080000-0x000000000208E000-memory.dmp

Download

memory/2352-1-0x0000000002080000-0x000000000208E000-memory.dmp

Download