icedid | 129780c3544a1f99557b2cacbafba1f812d436cc2b13796ce9b6db5926a98407

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 01:22

Target
JaffaCakes118_129780c3544a1f99557b2cacbafba1f812d436cc2b13796ce9b6db5926a98407.dll
Size 490KB
Sample241225-brlkbatjbs
SHA256 129780c3544a1f99557b2cacbafba1f812d436cc2b13796ce9b6db5926a98407
MD5 0caf4a341f920b255e1e8f15c2f41fd5
SHA1 fc3ea0f214ff443ce4f1b38d6925b116d2d97615
SHA512 5d6ee6465dbf888bdf44ed8acbe03b9568bae39d719bdc341831212629c0c23b960d095c4bdcaa28bdfe952a0e750a58429ff9897a4d13cfcdc432f9a8f357d8
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRB:knmj6xK1y3Ik6TZGRB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5032	regsvr32.exe
5032	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_129780c3544a1f99557b2cacbafba1f812d436cc2b13796ce9b6db5926a98407.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032

memory/5032-0-0x0000000001FA0000-0x0000000001FAE000-memory.dmp

Download

memory/5032-1-0x0000000001FA0000-0x0000000001FAE000-memory.dmp

Download