icedid | 83ce18ca6c3cf69feec6a4dcea11d1d3de37dc0f473dfcb3c4fc16ebd23ad9b0

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 23:08

Target

83ce18ca6c3cf69feec6a4dcea11d1d3de37dc0f473dfcb3c4fc16ebd23ad9b0.dll
Size

43KB
MD5

1c56a6e13ac26bb02c34edba4d1f7b00
SHA1

77ab65906b234766510a99c175e785894e3f8675
SHA256

83ce18ca6c3cf69feec6a4dcea11d1d3de37dc0f473dfcb3c4fc16ebd23ad9b0
SHA512

18c04a6678156f74945b26a37956fd09d1a37e8c0757e4f27450c6d21df2711c8181baf91682d045da411aca001cd87555b6c234557caa6c5936c4a3480b286b
SSDEEP

768:VZg+ZrV9rex+ublbcPyY79mbBwhc8vCVK1SsOVpzhy:oieQub7Y79m++8KVKwpNy

Score

10^/10

Family

icedid

Campaign

2843686224

missimokotov.space

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3956-1-0x0000000002220000-0x0000000002227000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3956	regsvr32.exe
3956	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\83ce18ca6c3cf69feec6a4dcea11d1d3de37dc0f473dfcb3c4fc16ebd23ad9b0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:388

memory/3956-1-0x0000000002220000-0x0000000002227000-memory.dmp

Filesize
28KB

Download