icedid | 4cf38891a9dbd5d649e39f1bc5171d1015f93727c65a41c281e004378a21a0da | Triage

Analysis

max time kernel
13s
max time network
110s
platform
windows10_x64
resource
win10v20210408
submitted
06-05-2021 14:10

Sharing

Report Analysis Logs

General

Target

f7de44db0b7db9428419a3ddde377836.dll
Size

42KB
MD5

f7de44db0b7db9428419a3ddde377836
SHA1

f966842f6c591f5f8daf3e87cf3eb374031af8b8
SHA256

4cf38891a9dbd5d649e39f1bc5171d1015f93727c65a41c281e004378a21a0da
SHA512

4c4ed4c1bf901605a6142559eb57f44c20801ed0161d6d6ade9f1f4678ff360c95a4d6d3c1cdcaf954d85486cdfdef64f41ab78e5c3993c335d9c4548c21ec91

Score

10^/10

icedid 1436894865 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1436894865

C2

jikkiaderwa.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

640 regsvr32.exe
640 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f7de44db0b7db9428419a3ddde377836.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-114-0x0000000001250000-0x000000000129D000-memory.dmp

Filesize
308KB

Download