icedid | 6c932d3c78cedf8a31df6035bf8e4924c3cd67b899f70209af67ae5f6e215624 | Triage

Analysis

max time kernel
4s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
02-04-2021 12:21

Sharing

Report Analysis Logs

General

Target

44285,5327891204.dat.dll
Size

199KB
MD5

48fa48c6e9f1c2a704089da688bbf95e
SHA1

8a03ebe9b44e8f0a1e3bc97eaa72a35afb38b021
SHA256

6c932d3c78cedf8a31df6035bf8e4924c3cd67b899f70209af67ae5f6e215624
SHA512

d805a62631e228bf1d8c9fb7e30e927214950a98946850533a39f7d6f09b624873a9dabd030795eb458e0ef7fded06ded22ad8c1c1fe012c8300027b47e5af32

Score

10^/10

icedid 1584008337 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1584008337

C2

stoikoplot.xyz

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1340-3-0x0000000000130000-0x0000000000137000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1340 regsvr32.exe
1340 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\44285,5327891204.dat.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-2-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Filesize
8KB

Download
memory/1340-3-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download