icedid | b8c296782102c76265bf524626520d3154ddcfd6440752514f23f702d760c55a

Analysis

max time kernel
121s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2023 19:16

Target

Malicious_b8c296782102c76265bf524626520d3154ddcfd6440752514f23f702d760c55a.dll
Size

75KB
MD5

98d1abb8fef28d64ebcdd3184dc6e2b1
SHA1

936d85a5fe28f1745b823df4c86bd0c6176bf62a
SHA256

b8c296782102c76265bf524626520d3154ddcfd6440752514f23f702d760c55a
SHA512

058d484f7683552937128c06fc91a6fcec47e61ecb79e5f2abbdbd904c52632109b4c08309f2c3be025b51f2c2bed76c697fbc12657024f59d13a724cc393cde
SSDEEP

1536:CY53MNyZS2TinPvX+3pBn9EYm3lHMyYoTivf:x530ysqinXU39E/3lRA

Score

10^/10

Family

icedid

Campaign

4213125251

asforthemines99.uno

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/3328-133-0x0000000001370000-0x0000000001377000-memory.dmp	IcedidFirstLoader
behavioral2/memory/3328-134-0x0000000001370000-0x0000000001377000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3328 regsvr32.exe
3328 regsvr32.exe

pid	process
3328	regsvr32.exe
3328	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Malicious_b8c296782102c76265bf524626520d3154ddcfd6440752514f23f702d760c55a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3328

memory/3328-133-0x0000000001370000-0x0000000001377000-memory.dmp

Filesize
28KB

Download
memory/3328-134-0x0000000001370000-0x0000000001377000-memory.dmp

Filesize
28KB

Download