Analysis
- max time kernel
4s - max time network
10s - platform
windows7_x64 - resource
win7v20201028 - submitted
31/03/2021, 04:19
General
- Target da5b94df12bcc409ec90165565296da1.dll
- Size 53KB
- Sample210331-t7rbenkyls
- SHA256 972fe8323abe2e1b5eebce12c9003db11276178dc63ff672b811960ed9c55735
Score
10/10
Malware Config
Extracted
Family
-
icedid
Campaign
-
3717128962
C2
-
usaaforced.fun
Signatures
- IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
- IcedID First Stage Loader 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\da5b94df12bcc409ec90165565296da1.dll1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/296-2-0x000007FEFC0A1000-0x000007FEFC0A3000-memory.dmp
memory/296-3-0x0000000000130000-0x0000000000137000-memory.dmp