icedid | 5b3fc1ff5d1316a44070c434404d0293c76742cb8168400e5d79431df9f7b7ef

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 07:28

Target

9401b310cf409b2efb41d4829241259c_JaffaCakes118.dll
Size

120KB
MD5

9401b310cf409b2efb41d4829241259c
SHA1

e00b95c4a66a6970a238e61b47fa00dc3c3e1942
SHA256

5b3fc1ff5d1316a44070c434404d0293c76742cb8168400e5d79431df9f7b7ef
SHA512

7ff25eb8d693f9fc933451028581d2436c701ddfab15d8fd10d4d6070683124dcad05978d2c920a3351eba131c3130871508e5280f4edb1d27c873d007c148f5
SSDEEP

3072:za+dUDMZJjkzSzh25YohAUwr3XnsOOujmZOta:wMZSzSzhA1rwDXnhZCSa

Score

10^/10

Family

icedid

loadwe4.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 4 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2308-12-0x0000000000110000-0x0000000000118000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2308-8-0x0000000000290000-0x0000000000296000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2308-4-0x00000000001F0000-0x00000000001F8000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2308-0-0x0000000000130000-0x000000000013A000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 992 wrote to memory of 2308	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 2308	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 2308	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 2308	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 2308	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 2308	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 2308	992	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9401b310cf409b2efb41d4829241259c_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\9401b310cf409b2efb41d4829241259c_JaffaCakes118.dll
2⤵
PID:2308

memory/2308-12-0x0000000000110000-0x0000000000118000-memory.dmp

Filesize
32KB

Download
memory/2308-8-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2308-4-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download
memory/2308-0-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download