icedid | 0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 14:09

Target

9e754bbe3e8d27ade46b544ca82d68b2_JaffaCakes118.dll
Size

224KB
MD5

9e754bbe3e8d27ade46b544ca82d68b2
SHA1

7a82992b50aefe5599c159bb069687250d7b00ab
SHA256

0dc2f51c2f087769a91ee4349a7dc94846427577a24ba6fffeaa9fd9a25a54bb
SHA512

6af4c48eb1c975b08c3a5fd7553e45aa064a39116442772fc3479a942a41b88125e434784a16c78917661c377d000251c820330d8de35cf4d8b3c27cac60e41e
SSDEEP

3072:U6VYA6I0oElwS9ciW+eM+ppv2LHFKp6+7bUSrtB0J3B1rq46vqDyPIKpPLq/M:UWxXElK+Spv2owSlt6JR1YSDuImq/M

Score

10^/10

Family

icedid

loadberlin.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
IcedID First Stage Loader 1 IoCs
loader

Processes:

resource yara_rule

behavioral1/memory/2076-1-0x00000000747D0000-0x0000000074814000-memory.dmp IcedidFirstLoader

resource	yara_rule
behavioral1/memory/2076-1-0x00000000747D0000-0x0000000074814000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 30 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2236 wrote to memory of 2076	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2076	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2076	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2076	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2076	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2076	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2076	2236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e754bbe3e8d27ade46b544ca82d68b2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e754bbe3e8d27ade46b544ca82d68b2_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:2076

memory/2076-1-0x00000000747D0000-0x0000000074814000-memory.dmp

Filesize
272KB

Download
memory/2076-0-0x0000000074807000-0x000000007480B000-memory.dmp

Filesize
16KB

Download