icedid | ce8a877579e9eb9d39f18c9edcae73a238307eb03a58f3b6cc17f2d4a218906e | Triage™

Analysis

max time kernel
12s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce8a877579e9eb9d39f18c9edcae73a238307eb03a58f.dll
Size 54KB
Sample210331-956v2w47c2
SHA256 ce8a877579e9eb9d39f18c9edcae73a238307eb03a58f3b6cc17f2d4a218906e
MD5 9779ad5c9705342d54765085ac61f395
SHA1 85bb2f5d38e49eeea1033627becce4f8fc45be45
SHA512 4d82669d8423c549e093ad47b6a1272668896de925fe5d75fd6bdaa2cc54390296d4f641670df6ea99b44f2a1bf748caa9d4b8f4483434eff4eb2d91c737d8fd
MD5 SHA1 SHA512

Score

10^/10

icedid 3722962361 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3722962361

C2

234tvgro.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/3888-2-0x00000000011F0000-0x00000000011F7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3888	regsvr32.exe
3888	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ce8a877579e9eb9d39f18c9edcae73a238307eb03a58f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3888-2-0x00000000011F0000-0x00000000011F7000-memory.dmp

Download