icedid | 9c04caf4d13616d00b08828ffd5fa12b5137df4bb0a67ebea21525f124e1c0f0

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 17:57 UTC

Target

9c04caf4d13616d00b08828ffd5fa12b5137df4bb0a67ebea21525f124e1c0f0.dll
Size

490KB
MD5

2ff8a957402091971df9a94de9e6233b
SHA1

2a8195849954f2a7151b8bd95731872f06d6604c
SHA256

9c04caf4d13616d00b08828ffd5fa12b5137df4bb0a67ebea21525f124e1c0f0
SHA512

9f141625282261bbee11506784904742c87c89880dbdc7cf2a1ab2faae079c1d4f826f172fd6cff890dd2aa11953f4251110ea48f3b563691c9605818ca24853
SSDEEP

12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRU:knmj6xK1y3Ik6TZGRU

Score

10^/10

Family

icedid

Campaign

3467965077

firenicatrible.com

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2440	regsvr32.exe
2440	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c04caf4d13616d00b08828ffd5fa12b5137df4bb0a67ebea21525f124e1c0f0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2440

No results found

memory/2440-0-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download
memory/2440-1-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download