icedid | fceccdeff5ec46186dfaf138f3aaf3d0e26b2f845b6345b3f19bca2130d951b5 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7v20210410
submitted
05-05-2021 18:03

Sharing

Report Analysis Logs

General

Target

fceccdeff5ec46186dfaf138f3aaf3d0e26b2f845b6345b3f19bca2130d951b5.dll
Size

12KB
MD5

cf9439ad83b1d89873f46ed27303b8bc
SHA1

52c3ed200cc9a66505df0f1a4e15227a73de9e55
SHA256

fceccdeff5ec46186dfaf138f3aaf3d0e26b2f845b6345b3f19bca2130d951b5
SHA512

5805a62dacb997dd815f98796c7727205570e226233da5e2fc7a20d6e20bbdf27c993728bb3eea4fae219161115dfdfb8544012a110e2b13be5fece57fdf6379

Score

10^/10

icedid 1386562008 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1386562008

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

788 regsvr32.exe
788 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fceccdeff5ec46186dfaf138f3aaf3d0e26b2f845b6345b3f19bca2130d951b5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-59-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

Filesize
8KB

Download