icedid | 705e14735da74b107357a676c15b07c0f0c86888b8f98ba86e1029ff4e4858df

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 05:50

Target

5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118.dll
Size

406KB
MD5

5d7ce2398942eb03bd0065aea3d5da15
SHA1

8c1977305284f6ef719d6e92f0e90f069476a62a
SHA256

705e14735da74b107357a676c15b07c0f0c86888b8f98ba86e1029ff4e4858df
SHA512

a014ab056f924d3a037df8bbdd59cc8e3f95a25c5c6fed04a5a90aa848aca5af2700b4ae1367d9a92efe7eb82265c8c5ecf5e24ba251bc752c68ba49bece9fa6
SSDEEP

6144:MU/OLpMfiR6vtVIgyPFiChgkX7WOMeLpebnZgUe4A29pNwzg:MU/OLCf1LqPACIeoFa4A29Dwzg

Score

10^/10

Family

icedid

ldrruble.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
IcedID First Stage Loader 1 IoCs
loader

Processes:

resource yara_rule

behavioral1/memory/2144-1-0x00000000747B0000-0x000000007486F000-memory.dmp IcedidFirstLoader

resource	yara_rule
behavioral1/memory/2144-1-0x00000000747B0000-0x000000007486F000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 30 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2116 wrote to memory of 2144	2116	rundll32.exe	rundll32.exe
PID 2116 wrote to memory of 2144	2116	rundll32.exe	rundll32.exe
PID 2116 wrote to memory of 2144	2116	rundll32.exe	rundll32.exe
PID 2116 wrote to memory of 2144	2116	rundll32.exe	rundll32.exe
PID 2116 wrote to memory of 2144	2116	rundll32.exe	rundll32.exe
PID 2116 wrote to memory of 2144	2116	rundll32.exe	rundll32.exe
PID 2116 wrote to memory of 2144	2116	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:2144

memory/2144-0-0x0000000074813000-0x0000000074817000-memory.dmp

Filesize
16KB

Download
memory/2144-1-0x00000000747B0000-0x000000007486F000-memory.dmp

Filesize
764KB

Download
memory/2144-4-0x0000000074813000-0x0000000074817000-memory.dmp

Filesize
16KB

Download