icedid | dc82551ef81d0f37ec220c6c1874efee3cff73e536488f1cd6e140f5ce20185b

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 17:55 UTC

Target

dc82551ef81d0f37ec220c6c1874efee3cff73e536488f1cd6e140f5ce20185b.dll
Size

490KB
MD5

71f19ef0a3ecea946767aa47a5b798ee
SHA1

9ee15c2a8f5b5b8b6c45db428f7b337796964c48
SHA256

dc82551ef81d0f37ec220c6c1874efee3cff73e536488f1cd6e140f5ce20185b
SHA512

448c5d82cd6d4c224dd3a930fadb860c123249c51625439ba146739916ba3f301f402c0c2915fc1609aea9a0c1e2435433efcd3d596244ef0dee7dbf4cb6535f
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRB:knmj6xK1y3Ik6TZGRB

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2516	regsvr32.exe
2516	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc82551ef81d0f37ec220c6c1874efee3cff73e536488f1cd6e140f5ce20185b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2516

No results found

memory/2516-0-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download
memory/2516-1-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download