icedid | 666a39015d53540460f6f3b5347d22457dfefd8ace09048503e7c20bb4ecd2f4 | Triage

Analysis

max time kernel
5s
max time network
12s
platform
windows7_x64
resource
win7v20210410
submitted
06-05-2021 00:02

Sharing

Report Analysis Logs

General

Target

4663d5c2_by_Libranalysis.dll
Size

226KB
MD5

4663d5c264c2a2ab8711e10cdeb9c138
SHA1

1e08012e2fb7a5f9237c9f21ae19b9b5a0cd979d
SHA256

666a39015d53540460f6f3b5347d22457dfefd8ace09048503e7c20bb4ecd2f4
SHA512

57827fb9bef53d71c50756b4180970420dfa371bfc5bd69f20ed20d643aa5d234f04c2ec822a9b2f4798fbc00ab573eacc7aa112e2c1b57c3cdb77aa8b2a365c

Score

10^/10

icedid 1386562008 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1386562008

C2

zasertiokil.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1084 regsvr32.exe
1084 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4663d5c2_by_Libranalysis.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-60-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download
memory/1084-61-0x00000000002D0000-0x0000000000316000-memory.dmp

Filesize
280KB

Download