icedid | 559c55ecc508157652cbe57091cbce5f4c6b4ca2c09c3a617f9fa760c8bcd693 | Triage™

Analysis

max time kernel
11s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea6441cfb39e7aa23fec2f9318387568.dll
Size 72KB
Sample210331-ppysx6xe1s
SHA256 559c55ecc508157652cbe57091cbce5f4c6b4ca2c09c3a617f9fa760c8bcd693
MD5 ea6441cfb39e7aa23fec2f9318387568
SHA1 f937086c5b6c28e6d9dc6fc11e61073bb7865a59
SHA512 dcc09347816de9f82ea33f3cdb93338d30a679e2029070b7280033ef3cecac54235304f896db2f97408f924ff050613d1c4422cd957d4ec42fec3836ef2f61c8
MD5 SHA1 SHA512

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3717128962

C2

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/4640-2-0x00000000001D0000-0x00000000001D7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4640	regsvr32.exe
4640	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ea6441cfb39e7aa23fec2f9318387568.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4640-2-0x00000000001D0000-0x00000000001D7000-memory.dmp

Download