icedid | 09a2442ad1cec2158088605f8ed11d433c4f57e93bde6d989f874b22ec2c5d1c

Analysis

max time kernel
149s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:26

Target
09a2442ad1cec2158088605f8ed11d433c4f57e93bde6d989f874b22ec2c5d1c.dll
Size 490KB
Sample260601-v1chjsbv9s
SHA256 09a2442ad1cec2158088605f8ed11d433c4f57e93bde6d989f874b22ec2c5d1c
MD5 956dfe9506b2db2d10fdc1092244a1d1
SHA1 66294b22b42ca0f33506f6237a4294fdf60241aa
SHA512 7997de0b75439c93c6037fd867d6e8e3948cb9ee76abde5e053cef1533f23d22421e595f3164e756d01d53d3f9b17fe5fa3e8c32b7cae12aadbaf5227ad65ab0
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaR0:knmj6xK1y3Ik6TZGR0
TLSH
T1EDB4E17173B005EAF8A3147048931A06C6717971233169DF9FA2125E9F3EBE1763AF26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Campaign

Family: IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3704	regsvr32.exe
3704	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\09a2442ad1cec2158088605f8ed11d433c4f57e93bde6d989f874b22ec2c5d1c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3704

memory/3704-0-0x00000000009B0000-0x00000000009BE000-memory.dmp

Download

memory/3704-1-0x00000000009B0000-0x00000000009BE000-memory.dmp

Download