icedid | 3ca166bc4bbd0d94a2c589bec498ef6476f0c672875646593f0cbc398c66d59c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2024, 14:37

Target
JaffaCakes118_3ca166bc4bbd0d94a2c589bec498ef6476f0c672875646593f0cbc398c66d59c.dll
Size 490KB
Sample241229-rzckdatmhr
SHA256 3ca166bc4bbd0d94a2c589bec498ef6476f0c672875646593f0cbc398c66d59c
MD5 46134f4303ac1121c98d4738e45ed953
SHA1 32f9c8b26685f25d622fbefe31d2c4ec1b511742
SHA512 d819774e0a8b3d12d55416ab309ca19560aa8a44c803abc23159e5f36a5ece3b1fcdd926955d44d529b7ed1fd1aa2d57cb273da71bb368e89b1d9ca7d69b842c
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRe:knmj6xK1y3Ik6TZGRe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
736	regsvr32.exe
736	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ca166bc4bbd0d94a2c589bec498ef6476f0c672875646593f0cbc398c66d59c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:736

memory/736-0-0x0000000002680000-0x000000000268E000-memory.dmp

Download

memory/736-1-0x0000000002680000-0x000000000268E000-memory.dmp

Download