icedid | 19995a1dd05fd6d0479ccd9f268bf713a4e7d873a7c68c368343e59dd7b7cad6

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 06:53

Target

8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll
Size

214KB
MD5

8640a5f8e0a61fb9908e48ebd0084ebc
SHA1

5222e4b1507008ee4a58cabf9d5d42da84be825c
SHA256

19995a1dd05fd6d0479ccd9f268bf713a4e7d873a7c68c368343e59dd7b7cad6
SHA512

06dde8e24f006b55532e31faac8daaf7ac8c968934101c6c304183dfd6f1c3122889c75c8389def4cc6669e034f01aac87b9315b5699e58dde65d8f61df47376
SSDEEP

6144:54+U6Ou0hTIXJnxeecA9ikbl4yB6ETGzM0y:a+U6Oleh9cA/lV6ETGw0y

Score

10^/10

Family

icedid

ldrshekel.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
IcedID First Stage Loader 1 IoCs
loader

Processes:

resource yara_rule

behavioral1/memory/3024-1-0x0000000074670000-0x0000000074707000-memory.dmp IcedidFirstLoader

resource	yara_rule
behavioral1/memory/3024-1-0x0000000074670000-0x0000000074707000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 28 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2980 wrote to memory of 3024	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 3024	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 3024	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 3024	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 3024	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 3024	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 3024	2980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:3024

memory/3024-1-0x0000000074670000-0x0000000074707000-memory.dmp

Filesize
604KB

Download
memory/3024-0-0x00000000746A4000-0x00000000746A8000-memory.dmp

Filesize
16KB

Download