icedid | 89252ad15ed6fccbb3988b41cc1a2ad7dc5a0baf5613e95ccfa38197fc681099 | Triage

Resubmissions

18-03-2021 03:59

210318-wv9baqw4g6 10

17-03-2021 17:11

210317-xgqr2pfh42 10

Analysis

max time kernel
122s
max time network
121s
platform
windows7_x64
resource
win7v20201028
submitted
18-03-2021 03:59

Sharing

Report Analysis Logs

General

Target

5a4c98e12ca3da692f71b20643e71c18.dll
Size

159KB
MD5

5a4c98e12ca3da692f71b20643e71c18
SHA1

af94deb35af44e66b8649ee1f24a29e862a19769
SHA256

89252ad15ed6fccbb3988b41cc1a2ad7dc5a0baf5613e95ccfa38197fc681099
SHA512

2da9880283f54adc84609309369a67f011c7aa89c631e5300187fea619ddd833d9fe74db8eae8562fb98bf8c552bdec9c3f29b3ee3a2dc12f58c6563a2f9f5bd

Score

10^/10

icedid 3574068153 Photoloader banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3574068153

C2

33nachoscocso.website

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1672-3-0x0000000001BF0000-0x0000000001BF7000-memory.dmp	IcedidFirstLoader

PhotoLoader Payload 1 IoCs

IcedID downloder-Photloader.

Processes:

resource	yara_rule
behavioral1/memory/1672-3-0x0000000001BF0000-0x0000000001BF7000-memory.dmp	crime_win32_icedid_stage1

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1672 regsvr32.exe
1672 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5a4c98e12ca3da692f71b20643e71c18.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-2-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download
memory/1672-3-0x0000000001BF0000-0x0000000001BF7000-memory.dmp

Filesize
28KB

Download