icedid | 14d40d257cad5f53c23cee35c9638abc0f8abaee5b2a21a6bee81a38a3f2662c | Triage

Resubmissions

18-03-2021 17:01

210318-k3gnd1nhbn 10

18-03-2021 12:12

210318-twskzb77t2 10

Analysis

max time kernel
115s
max time network
118s
platform
windows10_x64
resource
win10v20201028
submitted
18-03-2021 17:01

Sharing

Report Analysis Logs

General

Target

dat.dll
Size

75KB
MD5

a32a3b34436fc8dce9e1ab2f61cce1c9
SHA1

885587946e3100cf1373945e220833ef2ea44ad6
SHA256

14d40d257cad5f53c23cee35c9638abc0f8abaee5b2a21a6bee81a38a3f2662c
SHA512

e0129122e4713c01e621f8f3ad354438e43a869e8390c340767b7a3766532a7781f587a58c5b538adfda75da3f0e194d6aef491ad13b8077634ddf72cfdefd68

Score

10^/10

icedid 4213125251 Photoloader banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

4213125251

C2

188criolaserz.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/496-2-0x0000000000830000-0x0000000000837000-memory.dmp	IcedidFirstLoader

PhotoLoader Payload 1 IoCs

IcedID downloder-Photloader.

Processes:

resource	yara_rule
behavioral2/memory/496-2-0x0000000000830000-0x0000000000837000-memory.dmp	crime_win32_icedid_stage1

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

496 regsvr32.exe
496 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dat.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/496-2-0x0000000000830000-0x0000000000837000-memory.dmp

Filesize
28KB

Download