icedid | 0830b241bd1db51205beac5705b577fefbdc7d77087629f11289a7ce685c8841 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows10_x64
resource
win10v20201028
submitted
25-03-2021 17:04

Sharing

Report Analysis Logs

General

Target

44280.6945033565.dll
Size

52KB
MD5

c90fd2a4ca200c538ba3dfbc63158acc
SHA1

f770631fb86f7bf3c1fd80693df09cc506a0016b
SHA256

0830b241bd1db51205beac5705b577fefbdc7d77087629f11289a7ce685c8841
SHA512

8ab83068ce8ea4929c25f77e943a1c133b83ef5401d2faceb4ee02daf86a72567a5ce9ad047744fb97bc68ab7a7ea5660ec3fd87f8b8ae5c59fb91ce5e26d997

Score

10^/10

icedid 1211238709 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

feaser2347.club

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4772-2-0x0000000000D60000-0x0000000000D67000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4772 regsvr32.exe
4772 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\44280.6945033565.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4772-2-0x0000000000D60000-0x0000000000D67000-memory.dmp

Filesize
28KB

Download