icedid | 67fcd5fb2e3cef33770a3154b924886cb96de7808bff711065dbe5d5a18387f6

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 17:11 UTC

Target

67fcd5fb2e3cef33770a3154b924886cb96de7808bff711065dbe5d5a18387f6.dll
Size

490KB
MD5

9083e5e7184e91e319c0b6f8a7374813
SHA1

3156228620184bddca0e582c26eb5c2cc7cd41c1
SHA256

67fcd5fb2e3cef33770a3154b924886cb96de7808bff711065dbe5d5a18387f6
SHA512

16acfb1e853e5c19da973729f7446659cf4e6f5ce840e6761599ebddf59376e2c731d7659f327d4b260d7b3c4f7dd0b63edd83a72905be1d0a8eac7c8253573e
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR0:knmj6xK1y3Ik6TZGR0

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2272	regsvr32.exe
2272	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67fcd5fb2e3cef33770a3154b924886cb96de7808bff711065dbe5d5a18387f6.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2272

No results found

memory/2272-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/2272-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download