icedid | 2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba0246f164f0f2eccc952 | Triage

Analysis

max time kernel
5s
max time network
9s
platform
windows7_x64
resource
win7v20210408
submitted
06-05-2021 18:26

Sharing

Report Analysis Logs

General

Target

2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba.dll
Size

238KB
MD5

6aa51c55e5540eae3008a465edb5b38a
SHA1

e2802f3e9a832f3c208cef0a62b965d7ac6da557
SHA256

2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba0246f164f0f2eccc952
SHA512

3f100c8c28b2ac4785ba939263d2b868fc8519523627c0449ed2ae6d3bc3df2c3670644f43552b29d0115d0c172c16357954ae31b5a576feb9c3bedfc0577910

Score

10^/10

icedid 3042509645 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3042509645

C2

dsedertyhuiokle.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1640 regsvr32.exe
1640 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-60-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmp

Filesize
8KB

Download
memory/1640-61-0x0000000000130000-0x0000000000176000-memory.dmp

Filesize
280KB

Download