icedid | 8e51ccc6c8d14f0365d2d597c8aaf6015238839c0dab90e419107782bf460414 | Triage

Resubmissions

15-03-2021 17:20

210315-byxfckhc92 10

15-03-2021 17:08

210315-gs3bg6l69j 10

Analysis

max time kernel
238s
max time network
240s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 17:20

Sharing

Report Analysis Logs

General

Target

44270.7082388889.dat.dll
Size

43KB
MD5

5bf34d9fe5da5c093145b214738eabf3
SHA1

e7df362314fbb4ab7ff24674a3d8b87b082a86ea
SHA256

8e51ccc6c8d14f0365d2d597c8aaf6015238839c0dab90e419107782bf460414
SHA512

5ed65b263c8088b1e7664c7a35b27c60d3ce76d33468ce4dc070c7a8151d76a153ee11b7089e66f426cc7b77d30d5c5fb4ac0655a988d223b1bdec5469768f1f

Score

10^/10

icedid 2811148672 Photoloader banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2811148672

C2

asforthemines99.uno

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/548-3-0x00000000002C0000-0x00000000002C7000-memory.dmp	IcedidFirstLoader

PhotoLoader Payload 1 IoCs

IcedID downloder-Photloader.

Processes:

resource	yara_rule
behavioral1/memory/548-3-0x00000000002C0000-0x00000000002C7000-memory.dmp	crime_win32_icedid_stage1

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

548 regsvr32.exe
548 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\44270.7082388889.dat.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-2-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Filesize
8KB

Download
memory/548-3-0x00000000002C0000-0x00000000002C7000-memory.dmp

Filesize
28KB

Download