icedid | 1955160297e62c527599d783900b4748cb364ba24ae4c98fecf2fe27cc27bc8c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 03:44

Target
JaffaCakes118_1955160297e62c527599d783900b4748cb364ba24ae4c98fecf2fe27cc27bc8c.dll
Size 490KB
Sample241225-eam9cswrdy
SHA256 1955160297e62c527599d783900b4748cb364ba24ae4c98fecf2fe27cc27bc8c
MD5 82cdccefc407c425f884dcef01080b6b
SHA1 c321fee1990a99620c739765924229ebbd617604
SHA512 e8592c3f9e2ad520f7013088004e1ccc6f5db3bcc7671517316e794bc77ba7f8474f8b2ea3cfd40306912abba5104d47d7dc45c406993f7124614c7228a95644
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRU:knmj6xK1y3Ik6TZGRU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4632	regsvr32.exe
4632	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1955160297e62c527599d783900b4748cb364ba24ae4c98fecf2fe27cc27bc8c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632

memory/4632-0-0x00000000012D0000-0x00000000012DE000-memory.dmp

Download

memory/4632-1-0x00000000012D0000-0x00000000012DE000-memory.dmp

Download