icedid | 6336738df1d9a6bf7e94996c8283e6963b41dc3bc9ef93c25653d887a36041b1 | Triage

Resubmissions

06-05-2021 15:04

210506-rb5r4hbmqs 10

06-05-2021 14:10

210506-d5fe1txs3s 10

Analysis

max time kernel
124s
max time network
125s
platform
windows7_x64
resource
win7v20210408
submitted
06-05-2021 15:04

Sharing

Report Analysis Logs

General

Target

5c0b0feb91abf356951d511794e1f291.dll
Size

42KB
MD5

5c0b0feb91abf356951d511794e1f291
SHA1

f576e67a99e4907202aa8d867673fff7c1d1a2f4
SHA256

6336738df1d9a6bf7e94996c8283e6963b41dc3bc9ef93c25653d887a36041b1
SHA512

598ece9bdf5a4bc02465b85f1136b0e825adafec51994ec2ef34e6fa6ed6527d22655bc2c933598a8e77c07614a27e273d59ec1d2f50840afa7f3c08fd19170a

Score

10^/10

icedid 1436894865 Photoloader banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1436894865

C2

jikkiaderwa.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

PhotoLoader Payload 1 IoCs

IcedID downloder-Photloader.

Processes:

resource	yara_rule
behavioral1/memory/784-61-0x00000000003C0000-0x000000000040D000-memory.dmp	crime_win32_icedid_stage1

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

784 regsvr32.exe
784 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5c0b0feb91abf356951d511794e1f291.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-60-0x000007FEFB891000-0x000007FEFB893000-memory.dmp

Filesize
8KB

Download
memory/784-61-0x00000000003C0000-0x000000000040D000-memory.dmp

Filesize
308KB

Download