icedid | 8546fadd4beefeb13d1e3e338933fcfdad22f5bd0ca545504a07ecbde404b758 | Triage

Analysis

max time kernel
7s
max time network
9s
platform
windows7_x64
resource
win7v20210408
submitted
05-05-2021 23:48

Sharing

Report Analysis Logs

General

Target

icedid_5May21.dll
Size

12KB
MD5

252781235799f554b8e3960c6c01fdad
SHA1

66e53177e4cd3b84ec25f3de622e27a3b9fe1a18
SHA256

8546fadd4beefeb13d1e3e338933fcfdad22f5bd0ca545504a07ecbde404b758
SHA512

998ebd4a7591cc0d39299af90bd40b12f03fc4a31ff028c8d56eedfb9d5c706f95b1a8735540d01fc6b48d4ee896b981c16a1df0ed90a979a50784f65405352d

Score

10^/10

icedid 1386562008 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1386562008

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1684 regsvr32.exe
1684 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\icedid_5May21.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-60-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download