icedid | f175d5883a0958f8ce10c387fef6c6750d26089e7413bf7b9a3767b655e61417 | Triage

Analysis

max time kernel
5s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
16-03-2021 13:58

Sharing

Report Analysis Logs

General

Target

44271.5717447917_2.dat.dll
Size

43KB
MD5

997340ab32077836c7a055f52ab148de
SHA1

199045f7af5d7b2df7442c214afc13fbde7b54af
SHA256

f175d5883a0958f8ce10c387fef6c6750d26089e7413bf7b9a3767b655e61417
SHA512

7fcf09558782764b092f6c5123a6f70f847b77c4aae2b798873012ed4a0dd8810598ca44193348d7bff7db548150263058efdcf09ba3be56d4c6dc3649466a03

Score

10^/10

icedid 2811148672 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2811148672

C2

apoxiolazio55.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/748-3-0x0000000000170000-0x0000000000177000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

748 regsvr32.exe
748 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\44271.5717447917_2.dat.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-2-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmp

Filesize
8KB

Download
memory/748-3-0x0000000000170000-0x0000000000177000-memory.dmp

Filesize
28KB

Download