icedid | e0567d905a3912db934c530eb1dd62856ca6cdbf318afd72d3d0fb1c183296cd

Analysis

max time kernel
128s
max time network
133s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 07:39

Target

0d544614b47400768cf210c2e4d1a298e5cae36820c7b1b6327bb67b8e3ea8cb.exe.dll
Size

375KB
MD5

433c13f7ee510b61366bf8507fa40623
SHA1

c4a1608c53476053de3c7e8a9f4bb9436d62d5cd
SHA256

e0567d905a3912db934c530eb1dd62856ca6cdbf318afd72d3d0fb1c183296cd
SHA512

10f4adc2dd7ea79116d512a501a8a9009ffa519b4819de0e750542279dec2d8b2021ea9ebb78aed07a8e801d46979ee598725586d6b5da50abf75da29b18bfd2
SSDEEP

6144:/lvrP7tlUH7tBtGop4h1ee2k6Sn4s68dTcEgDAIpiWe97TzGux0siC6pEOEGElV/:9vrPsSo9tmNhdhb

Score

10^/10

Family

icedid

Campaign

1313163077

oilcardirtoz.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2044 regsvr32.exe
2044 regsvr32.exe

pid	process
2044	regsvr32.exe
2044	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0d544614b47400768cf210c2e4d1a298e5cae36820c7b1b6327bb67b8e3ea8cb.exe.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044

memory/2044-54-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download