Analysis

  • max time kernel
    10s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    21-04-2021 21:57

General

  • Target

    b52c0640957e5032b5160578f8cb99f9b066fde4f9431.dll

  • Size

    258KB

  • Sample

    210421-e14kya6b2s

  • MD5

    2cbed069a079c2c57946e9cccb1f1f72

  • SHA1

    18c4208d04d1b0a5d0e423cb60ca87fd64eabf80

  • SHA256

    b52c0640957e5032b5160578f8cb99f9b066fde4f9431ee6869b2eea67338f28

  • SHA512

    372cc5969492964dcbed070981b1fd443b53e1fbc23664f75bfa01ee96aefc733998ff9d586b8099f455a7f3546cfcf4190038a9dfeb54d94903d0f4beba84c4

Malware Config

Extracted

Family

icedid

Campaign

3351099083

C2

vaclicinni.xyz

Signatures 3

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • IcedID First Stage Loader ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs

Processes 1

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b52c0640957e5032b5160578f8cb99f9b066fde4f9431.dll
    Suspicious behavior: EnumeratesProcesses
    PID:3256

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/3256-114-0x0000000000E10000-0x0000000000E17000-memory.dmp