icedid | e88f86634b1a30b45429d6f721fef75902fb55a78629f1c0193e1629e955a55d | Triage

Analysis

max time kernel
124s
max time network
126s
platform
windows7_x64
resource
win7v20210410
submitted
17-04-2021 13:15

Sharing

Report Analysis Logs

General

Target

dll64.dll

Score

10^/10

icedid 2642071409 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2642071409

C2

netmoscito2.uno

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1088-60-0x0000000000130000-0x0000000000137000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1088 regsvr32.exe
1088 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dll64.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-59-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmp

Filesize
8KB

Download
memory/1088-60-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download