icedid | f74f9d5d75bd2de8703d1d1be958eda690e294d7e3d16d5547d7a4c8e99d6eb1

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 16:30 UTC

Target

f74f9d5d75bd2de8703d1d1be958eda690e294d7e3d16d5547d7a4c8e99d6eb1.dll
Size

490KB
MD5

82d20c5e272ecbdeac4a32c520a75653
SHA1

f5623a51a190e5868195a05bc3b5cf4dd904a90b
SHA256

f74f9d5d75bd2de8703d1d1be958eda690e294d7e3d16d5547d7a4c8e99d6eb1
SHA512

50adce6f9fed21a5d40d7a796cd8306f64f75989fec2ea71cefb74d59359d4fbb4db0374ff88e636734c657b5031a2f9b50f2e027e8ac601807d874941724e22
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRd:knmj6xK1y3Ik6TZGRd

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1728	regsvr32.exe
1728	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f74f9d5d75bd2de8703d1d1be958eda690e294d7e3d16d5547d7a4c8e99d6eb1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728

No results found

memory/1728-0-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/1728-1-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download