icedid | 8090f055532800645ce696420586473239f8d47c82546a8ed9a01063dfaa58d5

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
25/12/2024, 02:13

Target
JaffaCakes118_8090f055532800645ce696420586473239f8d47c82546a8ed9a01063dfaa58d5.dll
Size 490KB
Sample241225-cnes2atrbx
SHA256 8090f055532800645ce696420586473239f8d47c82546a8ed9a01063dfaa58d5
MD5 c6f9796cc08754206181636fcc7378ec
SHA1 e56e05966b0db493e7d06bd65544b99e79a750dd
SHA512 91173d2c394462bf695f8d94e94c9b9e9cde4b3b4343b5ac93e60e6b36134e3f5665d93a88f4b783652c50b02f3d9c830a0d1fa0935d56c8ed55dfd0cc136b2b
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRc:knmj6xK1y3Ik6TZGRc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	regsvr32.exe
2396	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8090f055532800645ce696420586473239f8d47c82546a8ed9a01063dfaa58d5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396

memory/2396-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/2396-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download