Analysis

  • max time kernel
    12s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    24-03-2021 20:44

General

  • Target

    a43189ea4bec9f81c51789011a7b2bb2e3e19028f9ebd31beaecf38abf273d02.dll

  • Size

    52KB

  • MD5

    6f6445c2847e0142f2e950224ba65bf2

  • SHA1

    87201f606cb08b573f043364b245cfebfb315027

  • SHA256

    a43189ea4bec9f81c51789011a7b2bb2e3e19028f9ebd31beaecf38abf273d02

  • SHA512

    35d8aeafcc6c1dd33c6ada92483ebbc39e4d7038b14636f17e6c8643a6906f3206e532aac4ff4f5f0d0d646e29c0d9e09e1c483b72f3f6cd66b2329641b2c5b9

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

feaser2347.club

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • IcedID First Stage Loader 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a43189ea4bec9f81c51789011a7b2bb2e3e19028f9ebd31beaecf38abf273d02.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1032-2-0x0000000000850000-0x0000000000857000-memory.dmp
    Filesize

    28KB