icedid | b2f613eeb08b96f3e09bc95fb26eccac8327ff3f9f3db14dcf3d51d62c58475a

Analysis

max time kernel
121s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2024 01:21

Target

b2f613eeb08b96f3e09bc95fb26eccac8327ff3f9f3db14dcf3d51d62c58475a.dll
Size

95KB
MD5

03ae7d0aaf88b66661a4ea4a560aae4c
SHA1

b3038f180ad2b831ed2d7190d8ff6a8402f5afd9
SHA256

b2f613eeb08b96f3e09bc95fb26eccac8327ff3f9f3db14dcf3d51d62c58475a
SHA512

ffa9f3e03dd2040e5b1a67286ad9a16a7d6287c977f3540c9896a99bec7628b620fe4c7b0b8277b75371de394441ab454b79cc3742ddfea52d15ea4510b3bcf6
SSDEEP

1536:CY53MNyZS2TinPvX+3pBn9EYm3lHMyYoTivfSN:x530ysqinXU39E/3lRA6N

Score

10^/10

Family

icedid

Campaign

4213125251

asforthemines99.uno

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/2420-1-0x0000000002110000-0x0000000002117000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2420 regsvr32.exe
2420 regsvr32.exe

pid	process
2420	regsvr32.exe
2420	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b2f613eeb08b96f3e09bc95fb26eccac8327ff3f9f3db14dcf3d51d62c58475a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420

memory/2420-1-0x0000000002110000-0x0000000002117000-memory.dmp

Filesize
28KB

Download