icedid | af5f6f066ffc8c375d6e4d1138d63da32014d7ea21b8b7582da0cd8b97794cbe

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 15:46

Target

af5f6f066ffc8c375d6e4d1138d63da32014d7ea21b8b7582da0cd8b97794cbe.com.dll
Size

161KB
MD5

13dc944a91cffd0385e29ea899a43af2
SHA1

793cfb6887fd324583ab1df77ff5e96391a3887b
SHA256

af5f6f066ffc8c375d6e4d1138d63da32014d7ea21b8b7582da0cd8b97794cbe
SHA512

258c0c920f0e76f2b883f967cf73114890f61abbee0824d9b2e913623feaeb53c2b1179bc34df49627fe39459e1d9b20986186015fa0168c7b452eeba7449c39
SSDEEP

3072:rag+wcWn3nAVoBOSMc3NtwhGNS+4is6b2:rJwYl3S1ub2

Score

10^/10

Family

icedid

Campaign

2271535685

babysoftletirs.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3588 regsvr32.exe
3588 regsvr32.exe

pid	process
3588	regsvr32.exe
3588	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\af5f6f066ffc8c375d6e4d1138d63da32014d7ea21b8b7582da0cd8b97794cbe.com.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3588

memory/3588-132-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/3588-138-0x0000000000930000-0x0000000000949000-memory.dmp

Filesize
100KB

Download