icedid | b898ce00a3b278fa41842781a562bec6e901402411aacfb0bc097db12b8a04ac | Triage

Analysis

max time kernel
12s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
26-04-2021 07:26

Sharing

Report Analysis Logs

General

Target

d446e14f75a94996edf918e0da285f5e.dll
Size

126KB
MD5

d446e14f75a94996edf918e0da285f5e
SHA1

ba4a4819eb600577327ae632ecd5e0dfe8e58d5a
SHA256

b898ce00a3b278fa41842781a562bec6e901402411aacfb0bc097db12b8a04ac
SHA512

779d8144ee98496aa7ed2e070fdee00aea5594c3b135884400bf6ad1d85353b8f47ece9976f9eb92291689be25aec31202d2ca1752553efca807b3c2985894c0

Score

10^/10

icedid 3451764797 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3451764797

C2

federallissimus.casa

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2112 regsvr32.exe
2112 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d446e14f75a94996edf918e0da285f5e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-114-0x00000000016C0000-0x0000000001706000-memory.dmp

Filesize
280KB

Download