icedid | fcaa9b727324e39d60d95e3e2a7d867fd55b7c73848a80a4e65e6c6a37585244

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/12/2024, 17:35

Target

fcaa9b727324e39d60d95e3e2a7d867fd55b7c73848a80a4e65e6c6a37585244.dll
Size

490KB
MD5

5b45714bb5d88677a52aae508d33f8ee
SHA1

1e098dea393b22ef07961ed3b345efa97a96bb42
SHA256

fcaa9b727324e39d60d95e3e2a7d867fd55b7c73848a80a4e65e6c6a37585244
SHA512

0eef9639281a601de7a12c31825c690e473fdc0325642c68c4e0954b49e265eea21e02a44124387cd63d4779d30ee2b2633dfb2a035a7f0c0acdd4670e7a0d99
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRh:knmj6xK1y3Ik6TZGRh

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
868	regsvr32.exe
868	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fcaa9b727324e39d60d95e3e2a7d867fd55b7c73848a80a4e65e6c6a37585244.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:868

memory/868-0-0x00000000026F0000-0x00000000026FE000-memory.dmp

Filesize
56KB

Download
memory/868-1-0x00000000026F0000-0x00000000026FE000-memory.dmp

Filesize
56KB

Download