icedid | 2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba0246f164f0f2eccc952 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows10_x64
resource
win10v20210410
submitted
06-05-2021 18:26

Sharing

Report Analysis Logs

General

Target

2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba.dll
Size

238KB
MD5

6aa51c55e5540eae3008a465edb5b38a
SHA1

e2802f3e9a832f3c208cef0a62b965d7ac6da557
SHA256

2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba0246f164f0f2eccc952
SHA512

3f100c8c28b2ac4785ba939263d2b868fc8519523627c0449ed2ae6d3bc3df2c3670644f43552b29d0115d0c172c16357954ae31b5a576feb9c3bedfc0577910

Score

10^/10

icedid 3042509645 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3042509645

C2

dsedertyhuiokle.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3680 regsvr32.exe
3680 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2af5157612e93d62d0eafad8d408a5f6b55b18d0cf2ba.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3680-114-0x0000000001F80000-0x0000000001FC6000-memory.dmp

Filesize
280KB

Download