icedid | 9d075b18bd7c1a71d298cbbac829ff9753f43caaf9e06681206adc78f45b68fa

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 11:48

Target

4aeb39eb230acd4a186a28d12a9d4354_JaffaCakes118.dll
Size

120KB
MD5

4aeb39eb230acd4a186a28d12a9d4354
SHA1

d36068381db2169c5d24e725968d5de3684f6bc3
SHA256

9d075b18bd7c1a71d298cbbac829ff9753f43caaf9e06681206adc78f45b68fa
SHA512

7e1b01e32c9a5ed787303df72d65e17b297b3b713dbe21c551460d5a8f8457a147eb0f67087f7f41fc24aacf856f2fcf029b9701885c04a01d5ebf5cd5bd7aae
SSDEEP

3072:za+dUDMZJjkzSzh25YohAUwr3XnsOOujmZOtg:wMZSzSzhA1rwDXnhZCSg

Score

10^/10

Family

icedid

loadwe4.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 4 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/1772-0-0x00000000001E0000-0x00000000001EA000-memory.dmp	IcedidFirstLoader
behavioral1/memory/1772-12-0x00000000001D0000-0x00000000001D8000-memory.dmp	IcedidFirstLoader
behavioral1/memory/1772-8-0x0000000000560000-0x0000000000566000-memory.dmp	IcedidFirstLoader
behavioral1/memory/1772-4-0x00000000001F0000-0x00000000001F8000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2784 wrote to memory of 1772	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 1772	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 1772	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 1772	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 1772	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 1772	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 1772	2784	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4aeb39eb230acd4a186a28d12a9d4354_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4aeb39eb230acd4a186a28d12a9d4354_JaffaCakes118.dll
2⤵
PID:1772

memory/1772-0-0x00000000001E0000-0x00000000001EA000-memory.dmp

Filesize
40KB

Download
memory/1772-12-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download
memory/1772-8-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/1772-4-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download