icedid | 4a6ecab4c22a7a6d8ae800b1f9065e86fc2af51c6cb5729ae6a478476d336ef1 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7v20201028
submitted
01-04-2021 18:43

Sharing

Report Analysis Logs

General

Target

4a6ecab4c22a7a6d8ae800b1f9065e86fc2af51c6cb5729ae6a478476d336ef1.dll
Size

198KB
MD5

44988e5de52d64d99dd0c92f1c36ce7b
SHA1

b6681661ddbed3825c38b7fea3cca3be7441c2c2
SHA256

4a6ecab4c22a7a6d8ae800b1f9065e86fc2af51c6cb5729ae6a478476d336ef1
SHA512

ff286e227f12fc286c5149bce0e5f4cfb5d13d7aded70e39847d21c2f084c3872de2e80c204451998295b8cb7fc8cb1920567f2d1249e19949e0069f5a5016c9

Score

10^/10

icedid 1584008337 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1584008337

C2

secondpilots.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1076-3-0x0000000000130000-0x0000000000137000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1076 regsvr32.exe
1076 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4a6ecab4c22a7a6d8ae800b1f9065e86fc2af51c6cb5729ae6a478476d336ef1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-2-0x000007FEFC4C1000-0x000007FEFC4C3000-memory.dmp

Filesize
8KB

Download
memory/1076-3-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download