icedid | 00c46232cdad873bf02787746fba9d196a6045bac1051154af7772f5b0f29b87

Analysis

max time kernel
155s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 09:09

Target

00c46232cdad873bf02787746fba9d196a6045bac1051154af7772f5b0f29b87.dll
Size

471KB
MD5

721097bbb0410e8fb12ec34a950ebd13
SHA1

faba9a762b51ca2fa01e70db88b654fcf0ca0b15
SHA256

00c46232cdad873bf02787746fba9d196a6045bac1051154af7772f5b0f29b87
SHA512

efa7a4d55827e2a30a3e41051565b6266c4decfa4af3793d588ac3655751e7cfcb4eeb5662d92620ff1a892727e33ddf1df2cc39fba7e84183002947375d4398
SSDEEP

6144:WeiF2seDNeh9IvEGALMJI6hOkNsgV24cGvMIw63mdNnAsRocWOHa49ZiN:WLsdNe6YLR6hxNTV5GnAgWIa49Zi

Score

10^/10

Family

icedid

Campaign

919308852

grendafolz.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4276 regsvr32.exe
4276 regsvr32.exe

pid	process
4276	regsvr32.exe
4276	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00c46232cdad873bf02787746fba9d196a6045bac1051154af7772f5b0f29b87.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4024 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:8
1⤵
PID:4084

memory/4276-0-0x0000000002B10000-0x0000000002B1E000-memory.dmp

Filesize
56KB

Download