icedid | babaf02a2ea4c03e9ea2bb01475757c9e39f96f71a9d7a76e722c64c0107c333 | Triage

Analysis

max time kernel
132s
max time network
133s
platform
windows7_x64
resource
win7v20210410
submitted
06-05-2021 07:33

Sharing

Report Analysis Logs

General

Target

dbcfa46a6d9b1810a22cc3ffeb583d49.dll
Size

98KB
MD5

dbcfa46a6d9b1810a22cc3ffeb583d49
SHA1

d2f02cdb3204b32b4a0f4618ac48f2be92722828
SHA256

babaf02a2ea4c03e9ea2bb01475757c9e39f96f71a9d7a76e722c64c0107c333
SHA512

accf3cd48712db0f92729cb7e54e94f4e9635224c9049fd7c779246d847d983da8f6e86b6d031f0cf6cc650f73c89e75138010cc326fb31729105734fe90e48f

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3717128962

C2

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-60-0x00000000004C0000-0x00000000004C7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2036 regsvr32.exe
2036 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dbcfa46a6d9b1810a22cc3ffeb583d49.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-59-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/2036-60-0x00000000004C0000-0x00000000004C7000-memory.dmp

Filesize
28KB

Download