Analysis

  • max time kernel
    127s
  • max time network
    64s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    06-05-2021 16:55

General

  • Target

    cf043f2d4c073eed412785bc432c8818.dll

  • Size

    160KB

  • MD5

    cf043f2d4c073eed412785bc432c8818

  • SHA1

    64a29e799724cbdbf304156714601dd9331e55ca

  • SHA256

    ccba26997d699542b90b5147c0f2bb3ecc06f20b14a89823ac98062ef8a74682

  • SHA512

    c12ec2d34c2fd1f6575d5118e52877e6b9335e26be31de27e5247b4c754fe9fc8ca187924a82bd68b9d1711fdea304e6263b2b5911265cb508914bb06bda8e1a

Malware Config

Extracted

Family

icedid

Campaign

861670232

C2

provokordino.space

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • IcedID First Stage Loader 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cf043f2d4c073eed412785bc432c8818.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/684-60-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp
    Filesize

    8KB

  • memory/684-61-0x00000000002B0000-0x00000000002B7000-memory.dmp
    Filesize

    28KB