icedid | 0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2024 10:53

Sharing

Target

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll
Size

38KB
MD5

a4017c06209e16b8f47fcf6e5845aba9
SHA1

66d99a1cc92ed316e0d7a2ab6df466c289154ec3
SHA256

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34
SHA512

52e4df915b3cb6eb60a3f37874b0d8a14646ffadb9aa621cf8ea3fb04b5cbb4250fb9cec3a2ed8722a7eae4b600836b5b7bf72e53e297e464fb844096a9b2f5e
SSDEEP

768:tojIJWP0znqX60+KU6nCVUO2gTjZSXulSJ474fLv/zkSf2Vz:NnqXn+YoQ+lu474zo

Score

10^/10

Family

icedid

Campaign

1910897067

epicprotovir.download

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
936	regsvr32.exe
936	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:936

memory/936-0-0x0000000002910000-0x000000000296B000-memory.dmp

Filesize
364KB

Download