icedid | 5458a4fb09d4fb08467b3c1cce37eecac72b68d2f3b15a701df053e5b284fc5e | Triage™

Analysis

max time kernel
12s
max time network
67s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e42bef8426a9bc4d56edd42ff7eeca0.dll
Size 111KB
Sample210331-xc9yp89lw2
SHA256 5458a4fb09d4fb08467b3c1cce37eecac72b68d2f3b15a701df053e5b284fc5e
MD5 4e42bef8426a9bc4d56edd42ff7eeca0
SHA1 23d3d606a27f001a284025825d86f7bb020faec4
SHA512 b19436af8536f1b8d8e1ccde68edc54cdc4e6d8631c90deb8f1136d40b952063c35ea4078fc5a43f8ead596692b35248861164b7caec01d1f77322e0b5779d9b
MD5 SHA1 SHA512

Score

10^/10

icedid 3633240867 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3633240867

C2

afdeserutil32.website

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/644-2-0x0000000000830000-0x0000000000837000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
644	regsvr32.exe
644	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4e42bef8426a9bc4d56edd42ff7eeca0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-2-0x0000000000830000-0x0000000000837000-memory.dmp

Download