icedid | 45704a092e0f331dec2c86dc2f7259b4680bb71c542aea59005bf1b1a8a18d3f

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16-11-2022 16:28

Target

45704a092e0f331dec2c86dc2f7259b4680bb71c542aea59005bf1b1a8a18d3f.dll
Size

96KB
MD5

f315325aecae49d502589694b6650bf0
SHA1

88b5d50c8e9e4f79b773a268da51a1f90718114c
SHA256

45704a092e0f331dec2c86dc2f7259b4680bb71c542aea59005bf1b1a8a18d3f
SHA512

ff9c89b5a7db2e1262aa87839d2ff41aff56861f241947ed8a857ac8f9904334269c74aff01bd4c8d1bf1f07d3ba1fa3ce02e1ef7c0e64a21e86e0501bd9cb2d
SSDEEP

1536:Z/Uo2DoDZjinBQFp5iVz+O22D9YUSh9T9S6PDJUTfhIr083GY2:Z/NhP5mzk2a7XsytW6083D2

Score

10^/10

Family

icedid

Campaign

1609463178

trolspeaksunt.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1468 rundll32.exe
1468 rundll32.exe

pid	process
1468	rundll32.exe
1468	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45704a092e0f331dec2c86dc2f7259b4680bb71c542aea59005bf1b1a8a18d3f.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1468

memory/1468-54-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1468-60-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download