icedid | cc54c29a01e64e6385bf853edc56f156f18128949620eb6008a00210d97f54d2

Analysis

max time kernel
91s
max time network
92s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
02-07-2023 19:12

Target

Malicious_cc54c29a01e64e6385bf853edc56f156f18128949620eb6008a00210d97f54d2.dll
Size

64KB
MD5

a3f36c27cd06188178c5e7dbca729c80
SHA1

33fd0cec359c664c250087b3afb44cefaf7da6b3
SHA256

cc54c29a01e64e6385bf853edc56f156f18128949620eb6008a00210d97f54d2
SHA512

4488a57f51f20c9ed272dfca614099682b338c024dff0bb9dc1950701de1163d9a55252a3213f7499387acfe574eae7be15f7b26a09b411827351b6a4113becc
SSDEEP

1536:roBHSfku/TguqNKM6C6E+YUv3EXmYOiKsU:roBS8Q0R68Xys

Score

10^/10

Family

icedid

Campaign

2046050

calldivorce.fun

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/872-54-0x0000000000140000-0x0000000000147000-memory.dmp	IcedidFirstLoader
behavioral1/memory/872-55-0x0000000000140000-0x0000000000147000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

872 regsvr32.exe
872 regsvr32.exe

pid	process
872	regsvr32.exe
872	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Malicious_cc54c29a01e64e6385bf853edc56f156f18128949620eb6008a00210d97f54d2.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:872

memory/872-54-0x0000000000140000-0x0000000000147000-memory.dmp

Filesize
28KB

Download
memory/872-55-0x0000000000140000-0x0000000000147000-memory.dmp

Filesize
28KB

Download