icedid | 7e0f852c50ed0664130482f2683c99ce6bbb67750bd5c10ffea21a2f1de5ab1e | Triage™

Analysis

max time kernel
14s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
01/04/2021, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e0f852c50ed0664130482f2683c99ce6bbb67750bd5c.dll
Size 198KB
Sample210401-fr8cs25a2e
SHA256 7e0f852c50ed0664130482f2683c99ce6bbb67750bd5c10ffea21a2f1de5ab1e
MD5 334d00797a81510d43a72ff0362c7646
SHA1 8f26e583f534fd1c938e90ad6be2cb2e8b72be66
SHA512 c38943e8d04a2949ce629fe541f308bcb682efc7bac6d3998d803ac8ae3931f3220c4cf5a26c38f29eafd50542c0be6683eb926f7ef21c21b754108cc8df6189
MD5 SHA1 SHA512

Score

10^/10

icedid 1584008337 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1584008337

C2

secondpilots.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/4716-2-0x0000000000560000-0x0000000000567000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	regsvr32.exe
4716	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7e0f852c50ed0664130482f2683c99ce6bbb67750bd5c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4716-2-0x0000000000560000-0x0000000000567000-memory.dmp

Download