icedid | da34f5e9f43b099aa31c503877fbb1ca12e4b0566ca1c65c797a203f3c23c6bb

Analysis

max time kernel
149s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 18:01

Target
da34f5e9f43b099aa31c503877fbb1ca12e4b0566ca1c65c797a203f3c23c6bb.dll
Size 490KB
Sample260601-wmax8sct61
SHA256 da34f5e9f43b099aa31c503877fbb1ca12e4b0566ca1c65c797a203f3c23c6bb
MD5 163db3328c041fa3391d56d83a5d1ad0
SHA1 f362003ea07f6551367169095b7b720d33a5f5df
SHA512 e19e49e4ee3bdb87bfee5758792a64d4cbaf6da6f7c1faada49c1c595e87000bc48bc039f02296deadac08fe3a6e3fd72cb4610409d9e92040114fef6660caff
SSDEEP 12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRT:knmj6xK1y3Ik6TZGRT
TLSH
T1E0B4E17173B005EAF8A3147048931A06C6717971233169DF9FA2125E9F3EBE1763AF26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Campaign

Family: IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4920	regsvr32.exe
4920	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\da34f5e9f43b099aa31c503877fbb1ca12e4b0566ca1c65c797a203f3c23c6bb.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920

memory/4920-0-0x0000000000DE0000-0x0000000000DEE000-memory.dmp

Download

memory/4920-1-0x0000000000DE0000-0x0000000000DEE000-memory.dmp

Download