icedid | baf946380919094e27db4d7052df02ea38846937f45b75a153cc2be4d6ba7ac8 | Triage

Analysis

max time kernel
124s
max time network
124s
platform
windows10_x64
resource
win10v20201028
submitted
24-03-2021 15:35

Sharing

Report Analysis Logs

General

Target

81c445deb337bba571f0a37cb753ae75.dll
Size

79KB
MD5

81c445deb337bba571f0a37cb753ae75
SHA1

6c48fe2cd2dadb3c86aaf3de0d01f7f1a5169df8
SHA256

baf946380919094e27db4d7052df02ea38846937f45b75a153cc2be4d6ba7ac8
SHA512

9d344127e8b50095064978e07f603df44469b76dc301db45c6cbdb77a85f37b17389cdfea020475048fda1d425b57054ec6cd06d57a90d4c57d4de235aab5130

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

912caporers.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/636-2-0x00000000015C0000-0x00000000015C7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

636 regsvr32.exe
636 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\81c445deb337bba571f0a37cb753ae75.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-2-0x00000000015C0000-0x00000000015C7000-memory.dmp

Filesize
28KB

Download