icedid | 2f785c547757bc5eabfb2653601520f11bc856963e4f2162a7e891289f33e8d9 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows10_x64
resource
win10v20201028
submitted
24-03-2021 22:16

Sharing

Report Analysis Logs

General

Target

2f785c547757bc5eabfb2653601520f11bc856963e4f2162a7e891289f33e8d9.dll
Size

52KB
MD5

e2c1b1aefd601994476ccd2e391cf5c8
SHA1

5aea3f8083370595fbfabfe6f40038c3ba2b0db7
SHA256

2f785c547757bc5eabfb2653601520f11bc856963e4f2162a7e891289f33e8d9
SHA512

c2e5c974301b6ca49a812be2aa9aa75b36d268cb10ff1b95e656fab40eb8de69dc5b8f3c9a657f40da783d124806b5cf5b13c4573135b3b91bb944495594f436

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

feaser2347.club

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4636-2-0x0000000000730000-0x0000000000737000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4636 regsvr32.exe
4636 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2f785c547757bc5eabfb2653601520f11bc856963e4f2162a7e891289f33e8d9.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-2-0x0000000000730000-0x0000000000737000-memory.dmp

Filesize
28KB

Download