icedid | 614461c405a183da7410ece59cdce4448513ba06044681a7e5161d08ef837903 | Triage™

Analysis

max time kernel
17s
max time network
116s
platform
windows10_x64
resource
win10v20201028
submitted
21/03/2021, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29fae5b9f869b4fb0a55b51fba335b71.dll
Size 64KB
Sample210321-eq9hlx3khx
SHA256 614461c405a183da7410ece59cdce4448513ba06044681a7e5161d08ef837903
MD5 29fae5b9f869b4fb0a55b51fba335b71
SHA1 2679ff97978111629573cd364a85049de71d4db6
SHA512 655598afff8f8843b1616ba4aed7122c546fccc35a67ac66c142770a36ff94d9e14bb54ed4156bd0b65d46405a36dd457e84be60734161deef4b9f286af5509a
MD5 SHA1 SHA512

Score

10^/10

icedid 2046050 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2046050

C2

calldivorce.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/492-2-0x0000000002800000-0x0000000002807000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
492	regsvr32.exe
492	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\29fae5b9f869b4fb0a55b51fba335b71.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-2-0x0000000002800000-0x0000000002807000-memory.dmp

Download