icedid | 4a637cb5c62d469c5d6e293a1e03d5a1bccca0556c58e67b6aab06e1122afbd9 | Triage

Analysis

max time kernel
123s
max time network
124s
platform
windows7_x64
resource
win7v20210410
submitted
06-05-2021 19:03

Sharing

Report Analysis Logs

General

Target

4a637cb5c62d469c5d6e293a1e03d5a1bccca0556c58e.dll
Size

238KB
MD5

4f9ac7226e67ccf960f2e7f0aa3aa64c
SHA1

2e58fbe14a618bd0fae85e53971be66cf440b3f0
SHA256

4a637cb5c62d469c5d6e293a1e03d5a1bccca0556c58e67b6aab06e1122afbd9
SHA512

e6b98271b976db5fc977770dabfc3f82a3db4cc7c6c0d7890d3a85be9ca237f40bab293d2bf57de59c13fb0c8608f924ecef4fb49bf134b8608beafa41d1c31b

Score

10^/10

icedid 3042509645 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3042509645

C2

barcafokliresd.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1864 regsvr32.exe
1864 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4a637cb5c62d469c5d6e293a1e03d5a1bccca0556c58e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-60-0x000007FEFC471000-0x000007FEFC473000-memory.dmp

Filesize
8KB

Download
memory/1864-61-0x00000000001C0000-0x0000000000206000-memory.dmp

Filesize
280KB

Download