icedid | 31405497b5a9ac591cc1098d3316d74717e18fec00a4f584495bd38c0b6aaf14 | Triage™

Analysis

max time kernel
11s
max time network
67s
platform
windows10_x64
resource
win10v20201028
submitted
29/03/2021, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcb0da7511d43759a209ecf77766139f.dll
Size 43KB
Sample210329-27e75jrb66
SHA256 31405497b5a9ac591cc1098d3316d74717e18fec00a4f584495bd38c0b6aaf14
MD5 fcb0da7511d43759a209ecf77766139f
SHA1 a58307ae4441289504f97cbc82596f197070edf1
SHA512 7316ea16852347d5ab34a53fd985faa146908b67fc5370f458aa5247d135a33921f791ae679398146e31bfe7c1538c8bc81d558b6ee84270a1f8d2e85cfe30e8
MD5 SHA1 SHA512

Score

10^/10

icedid 2843686224 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2843686224

C2

fivetonnbobavia.uno

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/1212-2-0x0000000000AA0000-0x0000000000AA7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1212	regsvr32.exe
1212	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fcb0da7511d43759a209ecf77766139f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-2-0x0000000000AA0000-0x0000000000AA7000-memory.dmp

Download