icedid | 75b2d8087831b26dfe63a0115686caabe6db159e59584bac57232cd026399d5d

Analysis

max time kernel
121s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 22:08

Target

75b2d8087831b26dfe63a0115686caabe6db159e59584bac57232cd026399d5d.dll
Size

167KB
MD5

f140b19f28a8922218fa5254b1e8b5d2
SHA1

504d359d38601bee6d705e8e7f9993114f92c62c
SHA256

75b2d8087831b26dfe63a0115686caabe6db159e59584bac57232cd026399d5d
SHA512

972ed980b0d16e41f7e293895caaf70037ab74e3fc12c740a607883313a64e3feb1a35339bbeee1c253484686e68bdcc9f3cf5ca0f2c3f9f986ed338b15b8e4e
SSDEEP

3072:Kse/i9cO0HJ5lBvqjh1Ft0vClziqkehkBlnz/ZCFTo:XT0HNBitbeClzi1xZCF0

Score

10^/10

Family

icedid

Campaign

3036641439

fintopikasling.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2224 regsvr32.exe
2224 regsvr32.exe

pid	process
2224	regsvr32.exe
2224	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\75b2d8087831b26dfe63a0115686caabe6db159e59584bac57232cd026399d5d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2224

memory/2224-0-0x00000000001E0000-0x00000000001E7000-memory.dmp

Filesize
28KB

Download
memory/2224-6-0x00000000001E0000-0x00000000001E7000-memory.dmp

Filesize
28KB

Download