icedid | 14c55b751b375e41af83f4c53753ec849ef368396cfc0e2830d92fd31383fab7

Analysis

max time kernel
107s
max time network
107s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-10-2022 14:17

Target

14c55b751b375e41af83f4c53753ec849ef368396cfc0e2830d92fd31383fab7.dll
Size

317KB
MD5

4a94ea3988c8c83e6618aaa256ba3b6c
SHA1

1ef1dc961fdc47643fb0572daee1d80c018bbd75
SHA256

14c55b751b375e41af83f4c53753ec849ef368396cfc0e2830d92fd31383fab7
SHA512

2d73dad533b0625ff32ed5fd256e4c58df0fae2ea8f0c6e5a0239aad210ee4fb439eb22062ce7c67d2e6813c9fe19a8d1d875d78a60b79c2effb21a57378ad2a
SSDEEP

6144:UiaIMPl3fdywZzWsIRhcY2EmQ77BkP7+sPI1AFN:UiaxP58X2ikP7U1AT

Score

10^/10

Family

icedid

Campaign

1023645195

trallfasterinf.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1356 rundll32.exe
1356 rundll32.exe

pid	process
1356	rundll32.exe
1356	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14c55b751b375e41af83f4c53753ec849ef368396cfc0e2830d92fd31383fab7.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1356

memory/1356-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1356-60-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download