icedid | 666a39015d53540460f6f3b5347d22457dfefd8ace09048503e7c20bb4ecd2f4 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows10_x64
resource
win10v20210408
submitted
06-05-2021 00:02

Sharing

Report Analysis Logs

General

Target

4663d5c2_by_Libranalysis.dll
Size

226KB
MD5

4663d5c264c2a2ab8711e10cdeb9c138
SHA1

1e08012e2fb7a5f9237c9f21ae19b9b5a0cd979d
SHA256

666a39015d53540460f6f3b5347d22457dfefd8ace09048503e7c20bb4ecd2f4
SHA512

57827fb9bef53d71c50756b4180970420dfa371bfc5bd69f20ed20d643aa5d234f04c2ec822a9b2f4798fbc00ab573eacc7aa112e2c1b57c3cdb77aa8b2a365c

Score

10^/10

icedid 1386562008 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1386562008

C2

zasertiokil.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

904 regsvr32.exe
904 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4663d5c2_by_Libranalysis.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-114-0x0000000002B80000-0x0000000002BC6000-memory.dmp

Filesize
280KB

Download