icedid | d41dc7c994809fa657b8217c6be5ff4f42a7daa61a14f5e711ce4d822bdeba70

Analysis

max time kernel
141s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 03:02

Target

a39e271f41128641553d2c6a7bb2d4c5_JaffaCakes118.dll
Size

120KB
MD5

a39e271f41128641553d2c6a7bb2d4c5
SHA1

70f7f5e2feea4a17bfd4af1591ff7869f88b5a92
SHA256

d41dc7c994809fa657b8217c6be5ff4f42a7daa61a14f5e711ce4d822bdeba70
SHA512

cff761348de074f250a4df3c7cf380ac5ec217cfc02bda4490c33d1b3189279fd64cd7717289f071433879ff01a571911193b1239c70f7511c9eccd9a5257fe1
SSDEEP

3072:za+dUDMZJjkzSzh25YohAUwr3XnsOOujmZOtw:wMZSzSzhA1rwDXnhZCSw

Score

10^/10

Family

icedid

loadwe4.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 4 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2132-12-0x00000000000C0000-0x00000000000C8000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2132-8-0x00000000001D0000-0x00000000001D6000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2132-4-0x0000000000100000-0x0000000000108000-memory.dmp	IcedidFirstLoader
behavioral1/memory/2132-0-0x00000000000F0000-0x00000000000FA000-memory.dmp	IcedidFirstLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2792 wrote to memory of 2132	2792	regsvr32.exe	regsvr32.exe
PID 2792 wrote to memory of 2132	2792	regsvr32.exe	regsvr32.exe
PID 2792 wrote to memory of 2132	2792	regsvr32.exe	regsvr32.exe
PID 2792 wrote to memory of 2132	2792	regsvr32.exe	regsvr32.exe
PID 2792 wrote to memory of 2132	2792	regsvr32.exe	regsvr32.exe
PID 2792 wrote to memory of 2132	2792	regsvr32.exe	regsvr32.exe
PID 2792 wrote to memory of 2132	2792	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a39e271f41128641553d2c6a7bb2d4c5_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a39e271f41128641553d2c6a7bb2d4c5_JaffaCakes118.dll
2⤵
PID:2132

memory/2132-12-0x00000000000C0000-0x00000000000C8000-memory.dmp

Filesize
32KB

Download
memory/2132-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2132-4-0x0000000000100000-0x0000000000108000-memory.dmp

Filesize
32KB

Download
memory/2132-0-0x00000000000F0000-0x00000000000FA000-memory.dmp

Filesize
40KB

Download