icedid | d306a9e5b59891e8eced5b995b95922e7bbdb2db4ea2db819349cf0d264843c1 | Triage™

Analysis

max time kernel
13s
max time network
107s
platform
windows10_x64
resource
win10v20201028
submitted
01/04/2021, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d306a9e5b59891e8eced5b995b95922e7bbdb2db4ea2d.dll
Size 198KB
Sample210401-vcfnw238n2
SHA256 d306a9e5b59891e8eced5b995b95922e7bbdb2db4ea2db819349cf0d264843c1
MD5 e7cb3ca91b7eaf1e512d8717f73c9251
SHA1 246be5925b81d3532ee11286f8548cbf1dcf8ffd
SHA512 48668197782ff603a4ee15dd7694728563dc72ddd97a44844e4e6fe4e49b9b62c26122894c641f642c2003d5eb21d37d64ae09cea19fc7da992a8dd145c52022
MD5 SHA1 SHA512

Score

10^/10

icedid 1584008337 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1584008337

C2

secondpilots.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/4764-2-0x0000000002580000-0x0000000002587000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4764	regsvr32.exe
4764	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d306a9e5b59891e8eced5b995b95922e7bbdb2db4ea2d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4764-2-0x0000000002580000-0x0000000002587000-memory.dmp

Download