icedid | 4646d0ec1ed0ef6f241858c944855e62bb4398c7edc3c40085b2089e976fb726 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows10_x64
resource
win10v20210410
submitted
06-05-2021 12:27

Sharing

Report Analysis Logs

General

Target

4646d0ec1ed0ef6f241858c944855e62bb4398c7edc3c40085b2089e976fb726.dll
Size

176KB
MD5

0d48fb1f5c0f457ca4506317d90802a1
SHA1

fd29d4e566bf73cd9ac3e87320a43b4e524792e5
SHA256

4646d0ec1ed0ef6f241858c944855e62bb4398c7edc3c40085b2089e976fb726
SHA512

a4a704b4e776af331146aaaf70006fb116051223529c06d02fa6e1f36efc25aa1743f8f790382582d057ce4d72c94dc513c1419db1cee9f2da198fafad304330

Score

10^/10

icedid 861670232 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

861670232

C2

provokordino.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3516-114-0x0000000000990000-0x0000000000997000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3516 regsvr32.exe
3516 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4646d0ec1ed0ef6f241858c944855e62bb4398c7edc3c40085b2089e976fb726.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3516-114-0x0000000000990000-0x0000000000997000-memory.dmp

Filesize
28KB

Download