icedid | 477183deeace02f1fb13a8fa5452e6d65c5bd65d124b02d4fc73e05bc34b6711 | Triage™

Analysis

max time kernel
14s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
01/04/2021, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
477183deeace02f1fb13a8fa5452e6d65c5bd65d124b0.dll
Size 198KB
Sample210401-9q6t764evx
SHA256 477183deeace02f1fb13a8fa5452e6d65c5bd65d124b02d4fc73e05bc34b6711
MD5 e16cdf6cf40cf77371c3f094b08bfbf8
SHA1 bb20205a463d10c0e6f32c2c52a9d3762c60d3e3
SHA512 398d1021397ca10c786e218547da2920bc42c7a9ecb49911b3d59138c9324433750b1c3c58de6fe6c387d1ff1acd62053125bdf0e09e55e7ce3f4ca62aefe462
MD5 SHA1 SHA512

Score

10^/10

icedid 1584008337 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1584008337

C2

secondpilots.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/584-2-0x0000000001040000-0x0000000001047000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
584	regsvr32.exe
584	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\477183deeace02f1fb13a8fa5452e6d65c5bd65d124b0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-2-0x0000000001040000-0x0000000001047000-memory.dmp

Download