icedid | 4cebb31bf05b288feb869bff17a381b2bf22ab5bbeab6e6b397a9ece7d80bced | Triage™

Analysis

max time kernel
14s
max time network
75s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e41a7d2bf559b300740b46cf3a0beed.dll
Size 93KB
Sample210331-n3hsahyy52
SHA256 4cebb31bf05b288feb869bff17a381b2bf22ab5bbeab6e6b397a9ece7d80bced
MD5 8e41a7d2bf559b300740b46cf3a0beed
SHA1 fc9a74007d3fd53718682c3d4de6d58ab9144691
SHA512 4ee72df134a946f98a83d237df8b8cc2efbf437d12dcd16ca9aed8d3f3eae1a6e1853c3fd177a87d7901bab4b614889c2363aaa2d2e1b68c51862c2cff9662df
MD5 SHA1 SHA512

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3717128962

C2

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/4736-2-0x0000000002380000-0x0000000002387000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	regsvr32.exe
4736	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e41a7d2bf559b300740b46cf3a0beed.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-2-0x0000000002380000-0x0000000002387000-memory.dmp

Download