icedid | f02ffa9c12507ec2d16d0c370b9e1ec83f5d8d365a16ff3a4fbca6583b3b1383

Analysis

max time kernel
141s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 04:06

Target
JaffaCakes118_f02ffa9c12507ec2d16d0c370b9e1ec83f5d8d365a16ff3a4fbca6583b3b1383.dll
Size 490KB
Sample241225-epln3sxngr
SHA256 f02ffa9c12507ec2d16d0c370b9e1ec83f5d8d365a16ff3a4fbca6583b3b1383
MD5 6736940562ed1604cb66a7aed149d66f
SHA1 43a048070503200d4f39704e2cc416e827ce326c
SHA512 7b283b99f428b9a4fd259178021677d12983fa301efbc10be8bd3caa20e8e1c074cbdd298f971e2db28980345f69a75382a3901b7602e9f07bee0109746b8bc2
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRg:knmj6xK1y3Ik6TZGRg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4104	regsvr32.exe
4104	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f02ffa9c12507ec2d16d0c370b9e1ec83f5d8d365a16ff3a4fbca6583b3b1383.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104

memory/4104-0-0x0000000001250000-0x000000000125E000-memory.dmp

Download

memory/4104-1-0x0000000001250000-0x000000000125E000-memory.dmp

Download