icedid | 0c4dfac552ffa283145e1e161b9d46b0fe5b47b54200269f3a486a795607c797 | Triage

Analysis

max time kernel
3s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
24-03-2021 16:23

Sharing

Report Analysis Logs

General

Target

02a4fc9c9c435b2347275a186c73c916.dll
Size

79KB
MD5

02a4fc9c9c435b2347275a186c73c916
SHA1

f70f759e76b3cae6f0fb68707d1634102f0255b1
SHA256

0c4dfac552ffa283145e1e161b9d46b0fe5b47b54200269f3a486a795607c797
SHA512

c74bac346fe070f055462b37819a95723b39d50ff62ffdb44177a04ab960ab8fa4217d8dcd1b4b9e85b7dc797c67c99b88e4c8de3e4c82f3a31da4aa116903e6

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

912caporers.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1684-3-0x0000000000130000-0x0000000000137000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1684 regsvr32.exe
1684 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\02a4fc9c9c435b2347275a186c73c916.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-2-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download
memory/1684-3-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download