icedid | 6fb512a27348df40379fd4324f03e536c81ea6624e57adbd2d2125567bff4287 | Triage

Analysis

max time kernel
8s
max time network
11s
platform
windows7_x64
resource
win7v20210408
submitted
06-05-2021 18:01

Sharing

Report Analysis Logs

General

Target

6fb512a27348df40379fd4324f03e536c81ea6624e57a.dll
Size

238KB
MD5

3431f436099a12a223f837c8b905c442
SHA1

4e9a15f49817da396030652a47381d766e306f62
SHA256

6fb512a27348df40379fd4324f03e536c81ea6624e57adbd2d2125567bff4287
SHA512

3780e80516bc91484daade6f28bf7c2fae9b9b45af05127aa2a211704442d549b3479df93399a18ba2f3114d6696b543f3ceb4a7e1579eca7fae1e3e5be78f0f

Score

10^/10

icedid 3042509645 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3042509645

C2

barcafokliresd.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1988 regsvr32.exe
1988 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6fb512a27348df40379fd4324f03e536c81ea6624e57a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-60-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Filesize
8KB

Download
memory/1988-61-0x00000000002E0000-0x0000000000326000-memory.dmp

Filesize
280KB

Download