icedid | 8c713bfd20e886f5328381b9f203c3480ee05dc73d6ca94a0462c718b92a739b | Triage

Analysis

max time kernel
123s
max time network
139s
platform
windows10_x64
resource
win10v20201028
submitted
27-02-2021 07:12

Sharing

Report Analysis Logs

General

Target

bcc19a640cbaa71a4b38af2604b06c11.dll
Size

5.2MB
MD5

bcc19a640cbaa71a4b38af2604b06c11
SHA1

ff92be3014ce38fba7c78d5cca03357b3c72e738
SHA256

8c713bfd20e886f5328381b9f203c3480ee05dc73d6ca94a0462c718b92a739b
SHA512

84c7be3b7ebed693837a0030b2786ff08547fe90895dc78f2492189108931827684c164ef2e5a352cc1965772698310bb59d6a96dd414553a337adfac6036b24

Score

10^/10

icedid 3109461289 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3109461289

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

4704 regsvr32.exe
4704 regsvr32.exe
4704 regsvr32.exe
4704 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bcc19a640cbaa71a4b38af2604b06c11.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4704-2-0x00007FF9A5360000-0x00007FF9A5362000-memory.dmp

Filesize
8KB

Download