icedid | c91847b9b00dddebd4f694412f2cc4c7346c15aa3cda2da856d9b0860a17ec50

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 16:22

Target

55a8da7ffdb5beeb293e27851793bb52_JaffaCakes118.dll
Size

211KB
MD5

55a8da7ffdb5beeb293e27851793bb52
SHA1

35fa0d2ce0d459524b79e3b3b839b50639a8052e
SHA256

c91847b9b00dddebd4f694412f2cc4c7346c15aa3cda2da856d9b0860a17ec50
SHA512

28ddd40b08bf83e89b0c92d89159e79f0103d7add097ab099a26103eb31f52a4ec9669290ccfa588d7075e71d712b34c10b625d644a425107535208307dbdb53
SSDEEP

6144:6ZLwRyyWMa3NIBkL6LDW8dTZdw702edvxiuYOO6umz4N:6ZLwRyyHadIBkLIi8dTL2SvguYOO1mkN

Score

10^/10

Family

icedid

ldrstar.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
IcedID First Stage Loader 1 IoCs
loader

Processes:

resource yara_rule

behavioral1/memory/2484-1-0x0000000074ED0000-0x0000000074F5C000-memory.dmp IcedidFirstLoader

resource	yara_rule
behavioral1/memory/2484-1-0x0000000074ED0000-0x0000000074F5C000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 36 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1516 wrote to memory of 2484	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 2484	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 2484	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 2484	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 2484	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 2484	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 2484	1516	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55a8da7ffdb5beeb293e27851793bb52_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55a8da7ffdb5beeb293e27851793bb52_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:2484

memory/2484-1-0x0000000074ED0000-0x0000000074F5C000-memory.dmp

Filesize
560KB

Download
memory/2484-0-0x0000000074F03000-0x0000000074F07000-memory.dmp

Filesize
16KB

Download