icedid | 746631dc739aa8cb35d20b8bce294d41a275538421a365245b9a909124c42a2f

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 15:00

Target
97707577346188009caefe94ba1e5ced.dll
Size 183KB
Sample240212-sdggwagf8z
SHA256 746631dc739aa8cb35d20b8bce294d41a275538421a365245b9a909124c42a2f
MD5 97707577346188009caefe94ba1e5ced
SHA1 755399be0ed6275a3fe7ac9f52a9f53f9e13a458
SHA512 0e4378a0c49ec28a3ede326591829418cb1a4ed900867fa94eeb39d05b224dce727a59c9fa1184ae097991cbc8dc30d55861a38abd2fe0335e576037281460de
SSDEEP 3072:hvZ/BpOppFOM5ene/KBJdjsFF4R7CQzK5rz12MYrH+Ricnm:R3Ip6M0nGKBJdjsFwG4gztYr80
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/2316-0-0x0000000075080000-0x00000000750C2000-memory.dmp	IcedidSecondLoader
behavioral2/memory/2316-4-0x0000000075080000-0x00000000750C2000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2316	1976	regsvr32.exe	85
PID 1976 wrote to memory of 2316	1976	regsvr32.exe	85
PID 1976 wrote to memory of 2316	1976	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\97707577346188009caefe94ba1e5ced.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\97707577346188009caefe94ba1e5ced.dll
  2⤵
  PID:2316

memory/2316-0-0x0000000075080000-0x00000000750C2000-memory.dmp

Download

memory/2316-1-0x0000000001400000-0x0000000001401000-memory.dmp

Download

memory/2316-4-0x0000000075080000-0x00000000750C2000-memory.dmp

Download