icedid | 85e5f25c3ceb380f4bc8622c2fbcb41b2f8cbb469b87d0995e9446e0015d60e1 | Triage™

Analysis

max time kernel
22s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
01/04/2021, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85e5f25c3ceb380f4bc8622c2fbcb41b2f8cbb469b87d.dll
Size 198KB
Sample210401-9859bggsnx
SHA256 85e5f25c3ceb380f4bc8622c2fbcb41b2f8cbb469b87d0995e9446e0015d60e1
MD5 37c017a3f95cc4196e54aec5e2be9b3d
SHA1 4068e1520cec172ea790d051726a4560e053915b
SHA512 b8660f882ebd4498f9226b1e69576ede8c07bf010645749e6721b2aa82be015fb408abb8519e4a7dd304598faa226cfb7bda5eb79b93ab23c4bab7756efcd45f
MD5 SHA1 SHA512

Score

10^/10

icedid 1584008337 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1584008337

C2

secondpilots.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/1048-2-0x0000000001520000-0x0000000001527000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1048	regsvr32.exe
1048	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\85e5f25c3ceb380f4bc8622c2fbcb41b2f8cbb469b87d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-2-0x0000000001520000-0x0000000001527000-memory.dmp

Download