icedid | def5ade35896dd4f503b7be8636e860d110512b62755f8b569877abab8dba375 | Triage

Analysis

max time kernel
13s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
24-03-2021 17:57

Sharing

Report Analysis Logs

General

Target

def5ade35896dd4f503b7be8636e860d110512b62755f.dll
Size

79KB
MD5

19fc7b78f361963d3f25874b6b894f62
SHA1

e0d5a9b02c18c5553da8ade6f8367d8b0b16146a
SHA256

def5ade35896dd4f503b7be8636e860d110512b62755f8b569877abab8dba375
SHA512

97d1b48d7f244932a5c9f25d35db9b7bcca09fa72856c1de97acda4985bb92a8b788b2a3084af68590fda2a7f2bbb5f0cea9d87967407f7655401c2d73db4211

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

912caporers.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/616-2-0x00000000011F0000-0x00000000011F7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

616 regsvr32.exe
616 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\def5ade35896dd4f503b7be8636e860d110512b62755f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-2-0x00000000011F0000-0x00000000011F7000-memory.dmp

Filesize
28KB

Download