icedid | 1c918e423a5860e55d247614f58b8a5bde30eb790b429b2ff86a4e9e2ae400c3 | Triage™

Analysis

max time kernel
90s
max time network
91s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c918e423a5860e55d247614f58b8a5bde30eb790b429.dll
Size 54KB
Sample210331-m8xm8p25qx
SHA256 1c918e423a5860e55d247614f58b8a5bde30eb790b429b2ff86a4e9e2ae400c3
MD5 a526584cc638d72d193709723108b491
SHA1 354425426a812bf4dd1fd4fc3ac0b33535fcc7d8
SHA512 c6cfb0cbcacc80c0640d15745241ccba2aa7f74d404666e383d3c69b938c70c650189f9ca7c7623f8f2461512fe6169b7482225ee81da50d35552c427ecc0631
MD5 SHA1 SHA512

Score

10^/10

icedid 3722962361 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3722962361

C2

234tvgro.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/1108-2-0x00000000004C0000-0x00000000004C7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	regsvr32.exe
1108	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1c918e423a5860e55d247614f58b8a5bde30eb790b429.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-2-0x00000000004C0000-0x00000000004C7000-memory.dmp

Download