icedid | fceec2c01e10a515818f3ada75cc98de746bb5337acd5eaabc0a175370516d07 | Triage™

Analysis

max time kernel
91s
max time network
115s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b74ac2a2dfeb2659aae36bb1af6db025.dll
Size 76KB
Sample210331-1n5vml753j
SHA256 fceec2c01e10a515818f3ada75cc98de746bb5337acd5eaabc0a175370516d07
MD5 b74ac2a2dfeb2659aae36bb1af6db025
SHA1 536275a8d6cb09017a7db4444a5cbdb7d8ef2ff5
SHA512 d6696b167cc770630984b2d6030722b9a3139ee5236bbfa9bdc100bd6a2c55caf2a29d9be88aef475aa1fbefa119236bfe35d116cf91af650428364a117fb201
MD5 SHA1 SHA512

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3717128962

C2

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/3996-2-0x00000000010D0000-0x00000000010D7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3996	regsvr32.exe
3996	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b74ac2a2dfeb2659aae36bb1af6db025.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3996-2-0x00000000010D0000-0x00000000010D7000-memory.dmp

Download