icedid | def5ade35896dd4f503b7be8636e860d110512b62755f8b569877abab8dba375 | Triage™

Analysis

max time kernel
13s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
24/03/2021, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
def5ade35896dd4f503b7be8636e860d110512b62755f.dll
Size 79KB
Sample210324-bmls64a9tx
SHA256 def5ade35896dd4f503b7be8636e860d110512b62755f8b569877abab8dba375
MD5 19fc7b78f361963d3f25874b6b894f62
SHA1 e0d5a9b02c18c5553da8ade6f8367d8b0b16146a
SHA512 97d1b48d7f244932a5c9f25d35db9b7bcca09fa72856c1de97acda4985bb92a8b788b2a3084af68590fda2a7f2bbb5f0cea9d87967407f7655401c2d73db4211
MD5 SHA1 SHA512

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

912caporers.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/616-2-0x00000000011F0000-0x00000000011F7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
616	regsvr32.exe
616	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\def5ade35896dd4f503b7be8636e860d110512b62755f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-2-0x00000000011F0000-0x00000000011F7000-memory.dmp

Download