icedid | ccba26997d699542b90b5147c0f2bb3ecc06f20b14a89823ac98062ef8a74682 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows10_x64
resource
win10v20210410
submitted
06-05-2021 17:02

Sharing

Report Analysis Logs

General

Target

ccba26997d699542b90b5147c0f2bb3ecc06f20b14a89823ac98062ef8a74682.dll
Size

160KB
MD5

cf043f2d4c073eed412785bc432c8818
SHA1

64a29e799724cbdbf304156714601dd9331e55ca
SHA256

ccba26997d699542b90b5147c0f2bb3ecc06f20b14a89823ac98062ef8a74682
SHA512

c12ec2d34c2fd1f6575d5118e52877e6b9335e26be31de27e5247b4c754fe9fc8ca187924a82bd68b9d1711fdea304e6263b2b5911265cb508914bb06bda8e1a

Score

10^/10

icedid 861670232 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

861670232

C2

provokordino.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3952-114-0x00000000007F0000-0x00000000007F7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3952 regsvr32.exe
3952 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ccba26997d699542b90b5147c0f2bb3ecc06f20b14a89823ac98062ef8a74682.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-114-0x00000000007F0000-0x00000000007F7000-memory.dmp

Filesize
28KB

Download