Overview

overview

10

Static

static

3

97c320926e...c8.dll

windows7-x64

10

97c320926e...c8.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 08:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    97c320926eba29d86197e65c87f5b8c8.dll

  • Size

    153KB

  • MD5

    97c320926eba29d86197e65c87f5b8c8

  • SHA1

    c47f7d4321a05f77a6389083df7ad71238775612

  • SHA256

    71fefd0b44412e24107cf6edea81ea0ae15ba7bcc2b7f1da99813f223eb36699

  • SHA512

    165f1bce2ecb523c689327796004f8eb68d7b21a6b8ede9355c0658c7da067b3979e40e38d7b3e25cd445d54730d96e05ea91f716e09694cf5fbb19d4a172907

  • SSDEEP

    1536:jR2Go6kANrzQ+2BpDM3UqZtWfp8wteoyFsNDxlv:Nto6kANrzQ+2BpDM3UqzWfp8St

Score
10/10
icedid2292720537bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

2292720537

C2

awefoplou5.site

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Icedid family
    icedid
  • IcedID First Stage Loader 1 IoCs
    loader
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\97c320926eba29d86197e65c87f5b8c8.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2520-1-0x0000000002C40000-0x0000000002C47000-memory.dmp

    Filesize

    28KB

    Download