icedid | f21eb8eeacf3eaf1abc3eccf6350b58919a536b6f381f98c365819714b4ceb53 | Triage

Analysis

max time kernel
150s
max time network
92s
platform
windows7_x64
resource
win7v20201028
submitted
24-03-2021 17:46

Sharing

Report Analysis Logs

General

Target

f21eb8eeacf3eaf1abc3eccf6350b58919a536b6f381f98c365819714b4ceb53.dll
Size

65KB
MD5

e1f9dc0d0b5c8855c6e91ec66f972cf7
SHA1

a81a694fa4af1fa6df53a547127e617887b2d7c3
SHA256

f21eb8eeacf3eaf1abc3eccf6350b58919a536b6f381f98c365819714b4ceb53
SHA512

9caac7d5d3b61c316f0c5f27d85f125491365cde2315bf7bc5c54033fa76fc51f86af50b929a8b486510550a6a15a5a8adb9e4019aaddbd72e4d50b722b30c33

Score

10^/10

icedid 3683573724 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3683573724

C2

24savetonnofmaoney.xyz

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/800-3-0x0000000000140000-0x0000000000147000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

800 regsvr32.exe
800 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f21eb8eeacf3eaf1abc3eccf6350b58919a536b6f381f98c365819714b4ceb53.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-2-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Filesize
8KB

Download
memory/800-3-0x0000000000140000-0x0000000000147000-memory.dmp

Filesize
28KB

Download