icedid | b898ce00a3b278fa41842781a562bec6e901402411aacfb0bc097db12b8a04ac | Triage™

Analysis

max time kernel
12s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
26/04/2021, 07:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d446e14f75a94996edf918e0da285f5e.dll
Size 126KB
Sample210426-netkdb3ays
SHA256 b898ce00a3b278fa41842781a562bec6e901402411aacfb0bc097db12b8a04ac
MD5 d446e14f75a94996edf918e0da285f5e
SHA1 ba4a4819eb600577327ae632ecd5e0dfe8e58d5a
SHA512 779d8144ee98496aa7ed2e070fdee00aea5594c3b135884400bf6ad1d85353b8f47ece9976f9eb92291689be25aec31202d2ca1752553efca807b3c2985894c0
MD5 SHA1 SHA512

Score

10^/10

icedid 3451764797 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3451764797

C2

federallissimus.casa

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2112	regsvr32.exe
2112	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d446e14f75a94996edf918e0da285f5e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-114-0x00000000016C0000-0x0000000001706000-memory.dmp

Download