icedid | 71fefd0b44412e24107cf6edea81ea0ae15ba7bcc2b7f1da99813f223eb36699 | Triage

Analysis

max time kernel
4s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
11-03-2021 14:55

Sharing

Report Analysis Logs

General

Target

Runtime.brok1.dll
Size

153KB
MD5

97c320926eba29d86197e65c87f5b8c8
SHA1

c47f7d4321a05f77a6389083df7ad71238775612
SHA256

71fefd0b44412e24107cf6edea81ea0ae15ba7bcc2b7f1da99813f223eb36699
SHA512

165f1bce2ecb523c689327796004f8eb68d7b21a6b8ede9355c0658c7da067b3979e40e38d7b3e25cd445d54730d96e05ea91f716e09694cf5fbb19d4a172907

Score

10^/10

icedid 2292720537 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2292720537

C2

awefoplou5.site

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2028-3-0x0000000000550000-0x0000000000557000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2028 regsvr32.exe
2028 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Runtime.brok1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-2-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download
memory/2028-3-0x0000000000550000-0x0000000000557000-memory.dmp

Filesize
28KB

Download