icedid | eb0adca8c97d6a9330de7020745a4055422273f8a2eb1e853eefbaf376ae7be8

Analysis

max time kernel
129s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2023 19:13

Target

Malicious_eb0adca8c97d6a9330de7020745a4055422273f8a2eb1e853eefbaf376ae7be8.dll
Size

64KB
MD5

a7836149b137ff301b3248e2d48c096c
SHA1

2b74ce76950976a2c4d2505b807c256d4caa37c2
SHA256

eb0adca8c97d6a9330de7020745a4055422273f8a2eb1e853eefbaf376ae7be8
SHA512

17111cc3c0dec84c61c850b49db2d7814afd30277ca4c0675afa9e8873bf1c195161be6345b6e8005bf1d0a2a019d11882988958f561de4b889b7f998c5a32f1
SSDEEP

1536:roBHSfku/TguqNKM6C6E+YUv3EXmYOiKsU:roBS8Q0R68Xys

Score

10^/10

Family

icedid

Campaign

2046050

calldivorce.fun

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/4212-133-0x0000000000DF0000-0x0000000000DF7000-memory.dmp	IcedidFirstLoader
behavioral2/memory/4212-134-0x0000000000DF0000-0x0000000000DF7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4212 regsvr32.exe
4212 regsvr32.exe

pid	process
4212	regsvr32.exe
4212	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Malicious_eb0adca8c97d6a9330de7020745a4055422273f8a2eb1e853eefbaf376ae7be8.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212

memory/4212-133-0x0000000000DF0000-0x0000000000DF7000-memory.dmp

Filesize
28KB

Download
memory/4212-134-0x0000000000DF0000-0x0000000000DF7000-memory.dmp

Filesize
28KB

Download