icedid | 872bc9beabc031d9b736dbc9b7a05dfa5a25bce335f0d345abec2606ada67094 | Triage

Analysis

max time kernel
4s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
24-03-2021 21:15

Sharing

Report Analysis Logs

General

Target

872bc9beabc031d9b736dbc9b7a05dfa5a25bce335f0d345abec2606ada67094.dll
Size

52KB
MD5

f0d0c5765f3da6b6d6653c8d98074477
SHA1

e8e7c42f5caa7341defb7e0af10cf95c0a0cae8c
SHA256

872bc9beabc031d9b736dbc9b7a05dfa5a25bce335f0d345abec2606ada67094
SHA512

0e8a5e15898d8999b6472ccaaaf8d5835f53b6425f2437e0c033a4c944f7875c487931d0aecf76489befd81b974b742db0c48b707f45d434e0ba42a02578decf

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

feaser2347.club

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1888-3-0x0000000000130000-0x0000000000137000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1888 regsvr32.exe
1888 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\872bc9beabc031d9b736dbc9b7a05dfa5a25bce335f0d345abec2606ada67094.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-2-0x000007FEFBA71000-0x000007FEFBA73000-memory.dmp

Filesize
8KB

Download
memory/1888-3-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download