icedid | b90a7589358093b5685c3fa284170bd67aa68f388a443c4cbcad3d87b415c8ea | Triage™

Analysis

max time kernel
123s
max time network
126s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b90a7589358093b5685c3fa284170bd67aa68f388a443.dll
Size 54KB
Sample210331-3pperdg1k2
SHA256 b90a7589358093b5685c3fa284170bd67aa68f388a443c4cbcad3d87b415c8ea
MD5 2b8c3efe9fb9f5d5cee7e5fead1ef8f1
SHA1 dbca8d2e0d7923a066365255d5205320b3b85166
SHA512 72a79bde48b0858657812204f9c2ebc1c4be9fb36d24c41486a923cf759f0a3cc79d8e57d6fa52d884ae02638f0c1a1867b7d7688817152b3871994a82b1da41
MD5 SHA1 SHA512

Score

10^/10

icedid 3722962361 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3722962361

C2

234tvgro.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/4708-2-0x0000000000870000-0x0000000000877000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4708	regsvr32.exe
4708	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b90a7589358093b5685c3fa284170bd67aa68f388a443.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4708-2-0x0000000000870000-0x0000000000877000-memory.dmp

Download