icedid | 79d5679290220fc57dcff7238494dc0728dbd9f3c69ee34ff6eefb792b9929d0 | Triage™

Analysis

max time kernel
14s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 05:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0730d3e8cf72cd5c4f5541f3a68daa7.dll
Size 95KB
Sample210331-jfvgqxfdvs
SHA256 79d5679290220fc57dcff7238494dc0728dbd9f3c69ee34ff6eefb792b9929d0
MD5 b0730d3e8cf72cd5c4f5541f3a68daa7
SHA1 daba10bf5d87fbb2602957aed56ba674e580a0cd
SHA512 283536dcef248cb7925744c60e06d313c223e5b2c74fe599d695628586024e4a00284c22b14888460821ee637908ae157997bef9c5a3ec0020b4cc77745dc994
MD5 SHA1 SHA512

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3717128962

C2

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/2268-2-0x00000000012F0000-0x00000000012F7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2268	regsvr32.exe
2268	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b0730d3e8cf72cd5c4f5541f3a68daa7.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-2-0x00000000012F0000-0x00000000012F7000-memory.dmp

Download