icedid | 38dc4eb0be3a9d753e58eeae18756b87604de9d915625fd07d887a15c7eaf1c6

Analysis

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 19:10

Target

Malicious_38dc4eb0be3a9d753e58eeae18756b87604de9d915625fd07d887a15c7eaf1c6.dll
Size

64KB
MD5

df172cee7e2e99ad19dff4d9d01a1fe7
SHA1

8a9d0f4ff35ca842c65dcffcec465d55bc0aa4af
SHA256

38dc4eb0be3a9d753e58eeae18756b87604de9d915625fd07d887a15c7eaf1c6
SHA512

201593414a6108184ada2b690830605d99acf5d5fce7a6fea86c4394471f07a53c4d8b75bfd8791e0d7e1bad634628042db59ea8c341929a3b7ee10115ee9205
SSDEEP

1536:roBHSfku/TguqNKM6C6E+YUv3EXmYOiKsU:roBS8Q0R68Xys

Score

10^/10

Family

icedid

Campaign

2046050

calldivorce.fun

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/1012-133-0x0000000000920000-0x0000000000927000-memory.dmp	IcedidFirstLoader
behavioral2/memory/1012-134-0x0000000000920000-0x0000000000927000-memory.dmp	IcedidFirstLoader

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4928C096-C572-458B-888F-1EE7214CD072}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B373BF15-7DE1-4507-93B6-47CA31518D00}.catalogItem	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1012	regsvr32.exe
1012	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Malicious_38dc4eb0be3a9d753e58eeae18756b87604de9d915625fd07d887a15c7eaf1c6.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:3044

memory/1012-133-0x0000000000920000-0x0000000000927000-memory.dmp

Filesize
28KB

Download
memory/1012-134-0x0000000000920000-0x0000000000927000-memory.dmp

Filesize
28KB

Download