icedid | 6fbf3d1c092ac3f9f7f76d4396776ec5162b7f85027c796530d5d3c9e3e923a4

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 16:17 UTC

Target

6fbf3d1c092ac3f9f7f76d4396776ec5162b7f85027c796530d5d3c9e3e923a4.dll
Size

490KB
MD5

8527947a73544ee934baecd2b87a3f9c
SHA1

df42c9e9c376b981c0466462cc30502e50e177d3
SHA256

6fbf3d1c092ac3f9f7f76d4396776ec5162b7f85027c796530d5d3c9e3e923a4
SHA512

933ee2792c5015578d360ebc4abfce89342904fc384de2b8063adf69d23548bb199cd531d9ab81d5deec7e70566ebbca4e63dfc6d0445c961a75d90d159da9ce
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRf:knmj6xK1y3Ik6TZGRf

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2756	regsvr32.exe
2756	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6fbf3d1c092ac3f9f7f76d4396776ec5162b7f85027c796530d5d3c9e3e923a4.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756

No results found

memory/2756-0-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download
memory/2756-1-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download