icedid | ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0

Analysis

max time kernel
127s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:17

Target

ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
Size

63KB
MD5

fcb6cf720c45b554c5f689fa914ffd2c
SHA1

4d247be7e4c3ee51c026c49dc4b9f59479e8ca77
SHA256

ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0
SHA512

a27fb5b32662f0624be8b96aaab8e8b09933dee0c996009970d8f7348d5df2142eb23f9215c35c95640a767399dce4636122dc81e58b5cc15ff3ffa3a6a86514
SSDEEP

768:/M8YFyCsg954KY86j8UIcufEHHsO1fA/lCM77EIgOC9Vi0VlLG:nC928URsO1fANvbgOCfk

Score

10^/10

Family

icedid

Campaign

2608516171

234willkids.uno

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

IcedID First Stage Loader 2 IoCs

loader

resource	yara_rule
behavioral1/memory/1744-0-0x0000000000150000-0x0000000000157000-memory.dmp	IcedidFirstLoader
behavioral1/memory/1744-1-0x0000000000150000-0x0000000000157000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1744	regsvr32.exe
1744	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1744

memory/1744-0-0x0000000000150000-0x0000000000157000-memory.dmp

Filesize
28KB

Download
memory/1744-1-0x0000000000150000-0x0000000000157000-memory.dmp

Filesize
28KB

Download