icedid | b83bbfa058d939c1aef487eee23267765b0a3bc9b005823c4a85ef84bdf2dbc3 | Triage

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7v20201028
submitted
24-03-2021 22:44

Sharing

Report Analysis Logs

General

Target

44279.8937025463.dat.dll
Size

52KB
MD5

a448f5921bbd62f24aa859dff1ccef94
SHA1

d1f8b98dc4d792449f0db3c4fd5faecd8f5b2707
SHA256

b83bbfa058d939c1aef487eee23267765b0a3bc9b005823c4a85ef84bdf2dbc3
SHA512

f2af92d27434ed477bde028922ae61809bb70e31bccf9275287b0371f3d82b76a1cb58e995a21d6d5110cbfe84d3f4ce6420408e5ddebff3ae8f6f0d9428a8a9

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

feaser2347.club

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/548-3-0x00000000001C0000-0x00000000001C7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

548 regsvr32.exe
548 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\44279.8937025463.dat.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-2-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Filesize
8KB

Download
memory/548-3-0x00000000001C0000-0x00000000001C7000-memory.dmp

Filesize
28KB

Download