icedid | 66356d51cfe73bfa04b5fac6b893b7c89c0226c32349e4609ff74b2a127542f5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 22:41

Target
66356d51cfe73bfa04b5fac6b893b7c89c0226c32349e4609ff74b2a127542f5.dll
Size 54KB
Sample240908-2l5dca1gke
SHA256 66356d51cfe73bfa04b5fac6b893b7c89c0226c32349e4609ff74b2a127542f5
MD5 ff97604b6516ed811255b49d4d428933
SHA1 124df61f29f2b5fbb41de564d7b2da1c426d2110
SHA512 8ea70808dc0c4ec6c3ed7b073b7a785ea825977432b3d5270ac308b9071167e0992697ffbf07da364ea9a73f88824944bccf41218b305816a8112c41174f37fb
SSDEEP 768:OhtkLEPNgcRjiKMulfwgggs30yGMtzVRWT/2KTeahM3J/IFmaDP:1Lybg+Ej30y7h8/casJ/IF5P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4404-1-0x0000000002AC0000-0x0000000002AC7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4404	regsvr32.exe
4404	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\66356d51cfe73bfa04b5fac6b893b7c89c0226c32349e4609ff74b2a127542f5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404

memory/4404-1-0x0000000002AC0000-0x0000000002AC7000-memory.dmp

Download