icedid | d0db91bd11f41eb10ee5dce39e37a71a05a96264caa11c7b01ac31125b81b072 | Triage™

Analysis

max time kernel
123s
max time network
125s
platform
windows10_x64
resource
win10v20210408
submitted
05/05/2021, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec6ea6fa0e91dd56cf84aefaac26e868.dll
Size 244KB
Sample210505-9lxabtxnt6
SHA256 d0db91bd11f41eb10ee5dce39e37a71a05a96264caa11c7b01ac31125b81b072
MD5 ec6ea6fa0e91dd56cf84aefaac26e868
SHA1 85ae98965a3802d284bfc76d81be9aecf092e6ea
SHA512 d2cd1c4770171a9e95be0115569d7f45865c0f6266a4ebc64e78907e9a0cf52d00ae7f59a490496a41a38bf0a48a2b6e7a07af5d2a4508f095ec99043c655fbe
MD5 SHA1 SHA512

Score

10^/10

icedid 3616463248 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3616463248

C2

tvorartificialnature.xyz

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/3704-114-0x0000000000410000-0x0000000000417000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3704	regsvr32.exe
3704	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec6ea6fa0e91dd56cf84aefaac26e868.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3704-114-0x0000000000410000-0x0000000000417000-memory.dmp

Download