icedid | 8273e7b7d052fe8bb4de30f67d6225602c53f130bc1ff253513d5fd47fa5783e | Triage™

Analysis

max time kernel
91s
max time network
97s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d904359425c94655d061c5178602e017.dll
Size 92KB
Sample210331-b5ggpdt5fs
SHA256 8273e7b7d052fe8bb4de30f67d6225602c53f130bc1ff253513d5fd47fa5783e
MD5 d904359425c94655d061c5178602e017
SHA1 255f9555c272cc8792d6ca28dba5db1c8f24b19a
SHA512 c0557e18a50ba3ccad948f0c6db267fb791f9ce946961a37825b1410b11b11dae420b3909e48db0db6ca8ebfd69e88bfb58004774673d9c175f835c7feddeec5
MD5 SHA1 SHA512

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3717128962

C2

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/648-2-0x0000000000BE0000-0x0000000000BE7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
648	regsvr32.exe
648	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d904359425c94655d061c5178602e017.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-2-0x0000000000BE0000-0x0000000000BE7000-memory.dmp

Download