icedid | 34f79afd74ff0d330fd7f0c4da8397e9b6572a62b8954c9032ddad98e3dd5d33 | Triage™

Analysis

max time kernel
12s
max time network
103s
platform
windows10_x64
resource
win10v20201028
submitted
02/04/2021, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0204_1.dll
Size 118KB
Sample210402-f8fc49f5fa
SHA256 34f79afd74ff0d330fd7f0c4da8397e9b6572a62b8954c9032ddad98e3dd5d33
MD5 ab37342ca883a24bc32f896f3e90236b
SHA1 af4b0d0a031fe8876182727903d0284211293937
SHA512 a7756dd9d66678048c9a6386efc5c10f58dc815fc7bb24200dbbbd9f74b0d33b436a94b595adbfc323934318a01583cf9cfa6aa3a2fcce02e5428eb9f0477bfe
MD5 SHA1 SHA512

Score

10^/10

icedid 3666796105 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3666796105

C2

nenepepe.pro

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/1056-2-0x00000000001C0000-0x00000000001C7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	regsvr32.exe
1056	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0204_1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-2-0x00000000001C0000-0x00000000001C7000-memory.dmp

Download