icedid | ebc42c6e58e85043723f27d02d6e67b4ddec6904530d96b97881afcd3546c99a | Triage

Analysis

max time kernel
14s
max time network
110s
platform
windows10_x64
resource
win10v20210408
submitted
06-05-2021 22:08

Sharing

Report Analysis Logs

General

Target

ebc42c6e58e85043723f27d02d6e67b4ddec6904530d96b97881afcd3546c99a.dll
Size

43KB
MD5

4e6c2e2871b5b8ab22bee2e811363a2d
SHA1

b2a7cdc4ebc3e7a34df1aaf21e4f03656e297777
SHA256

ebc42c6e58e85043723f27d02d6e67b4ddec6904530d96b97881afcd3546c99a
SHA512

a0c0e0327ed6059ca79a522fd92fba4e331872448c25a337d045aa50aa3b90c09e7a3ca40937092030ff9811ef90c7fc5852d3b54237c58bcd121721e6f96f1b

Score

10^/10

icedid 1436894865 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1436894865

C2

zasertiokil.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

900 regsvr32.exe
900 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ebc42c6e58e85043723f27d02d6e67b4ddec6904530d96b97881afcd3546c99a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-114-0x0000000002560000-0x00000000025AD000-memory.dmp

Filesize
308KB

Download