icedid | 281ee6c8ec6c393e11fbc5e41d6ac30720c975f3db44f9d6a2017ecc28679a76 | Triage

Resubmissions

02-04-2021 15:37

210402-yfg9fjpggn 10

02-04-2021 12:52

210402-xveza7elr2 10

Analysis

max time kernel
123s
max time network
122s
platform
windows7_x64
resource
win7v20201028
submitted
02-04-2021 15:37

Sharing

Report Analysis Logs

General

Target

Hodas.vyur.dll
Size

198KB
MD5

0c398cd7a7f62cfcca922886f3f0ce9e
SHA1

21a5b9d272aa59648f9a72cf4955a26032f48d45
SHA256

281ee6c8ec6c393e11fbc5e41d6ac30720c975f3db44f9d6a2017ecc28679a76
SHA512

bd318b9e4ae57cdf2ffb94e2c46c30bd9834d6dd435a47b37d0f87eb2e1ff432ea20e9b38050cf78d0671de092285be64bf0e3f48b534cd7d64cb02b2c88d2c8

Score

10^/10

icedid 1584008337 Photoloader banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1584008337

C2

secondpilots.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2028-3-0x0000000000130000-0x0000000000137000-memory.dmp	IcedidFirstLoader

PhotoLoader Payload 1 IoCs

IcedID downloder-Photloader.

Processes:

resource	yara_rule
behavioral1/memory/2028-3-0x0000000000130000-0x0000000000137000-memory.dmp	crime_win32_icedid_stage1

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2028 regsvr32.exe
2028 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Hodas.vyur.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-2-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download
memory/2028-3-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download