icedid | f6ea31d1b674431a77384e8e84b15522055fc9c90fe7ca7e1f666d447277af41 | Triage

Resubmissions

25-03-2021 11:08

210325-lbfj33e3pe 10

25-03-2021 09:49

210325-safqylnrm6 10

Analysis

max time kernel
122s
max time network
124s
platform
windows10_x64
resource
win10v20201028
submitted
25-03-2021 11:08

Sharing

Report Analysis Logs

General

Target

d72d6ddcbdf401c1b05da01824aabd92.dll
Size

52KB
MD5

d72d6ddcbdf401c1b05da01824aabd92
SHA1

21405e03bb9a929672d53c68b0d6d2facf24d394
SHA256

f6ea31d1b674431a77384e8e84b15522055fc9c90fe7ca7e1f666d447277af41
SHA512

f8cca66fdacba29d0ed3e315617c92400ddff902ec6a72262467394c9c6659cdd797ad43e20e47527522751b430a76a2f2ad12a4bff49a7ea76d781a0f88bd05

Score

10^/10

icedid 1211238709 Photoloader banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1211238709

C2

feaser2347.club

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/728-2-0x0000000000970000-0x0000000000977000-memory.dmp	IcedidFirstLoader

PhotoLoader Payload 1 IoCs

IcedID downloder-Photloader.

Processes:

resource	yara_rule
behavioral2/memory/728-2-0x0000000000970000-0x0000000000977000-memory.dmp	crime_win32_icedid_stage1

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

728 regsvr32.exe
728 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d72d6ddcbdf401c1b05da01824aabd92.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/728-2-0x0000000000970000-0x0000000000977000-memory.dmp

Filesize
28KB

Download