Analysis

  • max time kernel
    150s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    24-03-2021 19:47

General

  • Target

    79842399cd8917b4f77696727d4b6a52.dll

  • Size

    52KB

  • MD5

    79842399cd8917b4f77696727d4b6a52

  • SHA1

    dd018cc8bbdf17be3eff26c4c344165a380f76cf

  • SHA256

    0172c74ba54fb3fdb4da903253bb10e07815bc1c64821a336b1d89be3c5ce076

  • SHA512

    0476adff0e333396dd06af505f09ce1dc61230c03a5ac6f8f2ccab43646fb97eb73d716a8cbd43a203a7b77efa261336230fd4fc5349e55a75d387331fdc7692

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

feaser2347.club

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • IcedID First Stage Loader 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\79842399cd8917b4f77696727d4b6a52.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1968-2-0x000007FEFB831000-0x000007FEFB833000-memory.dmp
    Filesize

    8KB

  • memory/1968-3-0x0000000000130000-0x0000000000137000-memory.dmp
    Filesize

    28KB