icedid | c14f7ece9b6c84d7e81839663fdfcb3cd3eacd06503f02e1cd4ccd9bb90019ca

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 05:24

Target

861613cdfa40542f4890c5ec8ffa8ea4_JaffaCakes118.dll
Size

120KB
MD5

861613cdfa40542f4890c5ec8ffa8ea4
SHA1

1dc83b843d335b6e4f6e964739891d11f63f30b0
SHA256

c14f7ece9b6c84d7e81839663fdfcb3cd3eacd06503f02e1cd4ccd9bb90019ca
SHA512

76f355c680b40cef7332bfadd63d4f4e15b65c531b9d445344065c5a0a200210ac8ede75dcdd9852e3b08221c87b8a4cbf57c5e6b6db4164719d6382e7c5ea64
SSDEEP

3072:za+dUDMZJjkzSzh25YohAUwr3XnsOOujmZOtT:wMZSzSzhA1rwDXnhZCST

Score

10^/10

Family

icedid

loadwe4.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 4 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2292-4-0x0000000000260000-0x0000000000268000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2292-0-0x00000000001D0000-0x00000000001DA000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2292-10-0x00000000000C0000-0x00000000000C8000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2292-8-0x0000000000440000-0x0000000000446000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\861613cdfa40542f4890c5ec8ffa8ea4_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\861613cdfa40542f4890c5ec8ffa8ea4_JaffaCakes118.dll
2⤵
PID:2292

memory/2292-4-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/2292-0-0x00000000001D0000-0x00000000001DA000-memory.dmp

Filesize
40KB

Download
memory/2292-10-0x00000000000C0000-0x00000000000C8000-memory.dmp

Filesize
32KB

Download
memory/2292-8-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download