Analysis
- max time kernel
150s - max time network
153s - platform
windows7_x64 - resource
win7v20201028 - submitted
01/04/2021, 18:04
General
- Target 7e0f852c50ed0664130482f2683c99ce6bbb67750bd5c.dll
- Size 198KB
- Sample210401-fr8cs25a2e
- SHA256 7e0f852c50ed0664130482f2683c99ce6bbb67750bd5c10ffea21a2f1de5ab1e
Score
10/10
Malware Config
Extracted
Family
-
icedid
Campaign
-
1584008337
C2
-
secondpilots.space
Signatures
- IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
- IcedID First Stage Loader 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7e0f852c50ed0664130482f2683c99ce6bbb67750bd5c.dll1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1924-2-0x000007FEFC021000-0x000007FEFC023000-memory.dmp
memory/1924-3-0x00000000001B0000-0x00000000001B7000-memory.dmp