icedid | 503c3fc75984b23df59f3e53416764f2392bc76b16cb73bba7027fe86914888d | Triage

Analysis

max time kernel
12s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
24-03-2021 17:08

Sharing

Report Analysis Logs

General

Target

925355f1fa8192f98db0f73bb7b15a38.dll
Size

79KB
MD5

925355f1fa8192f98db0f73bb7b15a38
SHA1

d0f1624b2ebe851a0966aeff2d0fb32dafd66605
SHA256

503c3fc75984b23df59f3e53416764f2392bc76b16cb73bba7027fe86914888d
SHA512

4961c2f054eaa0d0d53ab71eb370e76a4505d541cea0077c0c8546a32198d6ed5dbd431f1722bc21a899ddfbe828d54d70a71b7e99d8a9cca019214565bd8d03

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

912caporers.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3976-2-0x0000000001390000-0x0000000001397000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3976 regsvr32.exe
3976 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\925355f1fa8192f98db0f73bb7b15a38.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3976-2-0x0000000001390000-0x0000000001397000-memory.dmp

Filesize
28KB

Download