icedid | 6d95973c17ad6ed8353f07422fae2894c283a329386c464d0c702679f3ab2b26 | Triage

Analysis

max time kernel
39s
max time network
38s
platform
windows7_x64
resource
win7v20201028
submitted
24-03-2021 21:15

Sharing

Report Analysis Logs

General

Target

6d95973c17ad6ed8353f07422fae2894c283a329386c464d0c702679f3ab2b26.dll
Size

52KB
MD5

8b27654b7eba6d7645d976891bd0f812
SHA1

0dfe85ebd27151f1c41eba6e0e2f4824cd7c3c12
SHA256

6d95973c17ad6ed8353f07422fae2894c283a329386c464d0c702679f3ab2b26
SHA512

b58c49fcb8a89bc064726dc201102d659e791878faa31d97163d5e6047b3f3c431b3375517f494f6fcb6a94875e4353bda20d2e3d58df59e44b6471867ff23d7

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

feaser2347.club

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1072-3-0x00000000001B0000-0x00000000001B7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1072 regsvr32.exe
1072 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6d95973c17ad6ed8353f07422fae2894c283a329386c464d0c702679f3ab2b26.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-2-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download
memory/1072-3-0x00000000001B0000-0x00000000001B7000-memory.dmp

Filesize
28KB

Download