icedid | 935f8795a9db0710227e16b9e0371cfe8d61cbcbc2e331b0eb4d11ba67fb51ba | Triage™

Analysis

max time kernel
16s
max time network
140s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c02efdba321f4efa8b3f79043377b04f.dll
Size 65KB
Sample210331-kgd2wwgrc2
SHA256 935f8795a9db0710227e16b9e0371cfe8d61cbcbc2e331b0eb4d11ba67fb51ba
MD5 c02efdba321f4efa8b3f79043377b04f
SHA1 c93ebbc99d21c02d95fa33b8d4f12f564507808c
SHA512 f8379172f939b5b9d1ca8e9a498cf1e32b5bd0a5ff4c6961195d270a6c492080a9789bb83998e7d8ce969a2aa084bb6ecb653cd9e2ecc3d4e8dd0a37ce87a8ca
MD5 SHA1 SHA512

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3717128962

C2

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/4716-2-0x0000000000ED0000-0x0000000000ED7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	regsvr32.exe
4716	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c02efdba321f4efa8b3f79043377b04f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4716-2-0x0000000000ED0000-0x0000000000ED7000-memory.dmp

Download