Analysis
- max time kernel
150s - max time network
151s - platform
windows7_x64 - resource
win7v20201028 - submitted
31/03/2021, 04:40
General
- Target c02efdba321f4efa8b3f79043377b04f.dll
- Size 65KB
- Sample210331-kgd2wwgrc2
- SHA256 935f8795a9db0710227e16b9e0371cfe8d61cbcbc2e331b0eb4d11ba67fb51ba
Score
10/10
Malware Config
Extracted
Family
-
icedid
Campaign
-
3717128962
C2
-
usaaforced.fun
Signatures
- IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
- IcedID First Stage Loader 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c02efdba321f4efa8b3f79043377b04f.dll1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/892-2-0x000007FEFB931000-0x000007FEFB933000-memory.dmp
memory/892-3-0x00000000001B0000-0x00000000001B7000-memory.dmp