icedid | d8d0ca5e414127bb47bf966e50a1eda7892c69f2592d719feda4b910e106a17a | Triage™

Analysis

max time kernel
16s
max time network
70s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
69b177af5dc0aa6ac455501427f83e66.dll
Size 113KB
Sample210331-hax9h7a35e
SHA256 d8d0ca5e414127bb47bf966e50a1eda7892c69f2592d719feda4b910e106a17a
MD5 69b177af5dc0aa6ac455501427f83e66
SHA1 9970a4a325c5a71cb6ea2ef1b21e42537fdaecd4
SHA512 cc5c0d55892f0eba2f056741da333fb0d3ce45dae3980b63926bb694e96fd04cc6730ce7b81a8cc69c17258cc32834d1e0405064cece4412ebf449d7fcb8919b
MD5 SHA1 SHA512

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3717128962

C2

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/1052-2-0x0000000000D70000-0x0000000000D77000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1052	regsvr32.exe
1052	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\69b177af5dc0aa6ac455501427f83e66.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-2-0x0000000000D70000-0x0000000000D77000-memory.dmp

Download