icedid | 80ff2a21f0798873593b0f06f0860221019933f12fe4c623fabb5fe1062b4789 | Triage

Analysis

max time kernel
4s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
02-04-2021 12:50

Sharing

Report Analysis Logs

General

Target

Hodas_1.vyur.dll
Size

199KB
MD5

1273fa4d6935760f15e42a61045b7a6c
SHA1

3017f1ecce5378e7b30ee14f244337c34ca37d48
SHA256

80ff2a21f0798873593b0f06f0860221019933f12fe4c623fabb5fe1062b4789
SHA512

2da9f1a6217e92afe88e25fb5bbe4f133daa7fb5e56f63d2c5e72a38121d60644e37dd2de022886fd02f43abcaac237a2b514624160ebd219e9994c2757ef700

Score

10^/10

icedid 1584008337 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1584008337

C2

stoikoplot.xyz

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1576-3-0x0000000000150000-0x0000000000157000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1576 regsvr32.exe
1576 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Hodas_1.vyur.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1576-2-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Filesize
8KB

Download
memory/1576-3-0x0000000000150000-0x0000000000157000-memory.dmp

Filesize
28KB

Download