icedid | ccba26997d699542b90b5147c0f2bb3ecc06f20b14a89823ac98062ef8a74682 | Triage

Analysis

max time kernel
127s
max time network
64s
platform
windows7_x64
resource
win7v20210408
submitted
06-05-2021 16:55

Sharing

Report Analysis Logs

General

Target

cf043f2d4c073eed412785bc432c8818.dll
Size

160KB
MD5

cf043f2d4c073eed412785bc432c8818
SHA1

64a29e799724cbdbf304156714601dd9331e55ca
SHA256

ccba26997d699542b90b5147c0f2bb3ecc06f20b14a89823ac98062ef8a74682
SHA512

c12ec2d34c2fd1f6575d5118e52877e6b9335e26be31de27e5247b4c754fe9fc8ca187924a82bd68b9d1711fdea304e6263b2b5911265cb508914bb06bda8e1a

Score

10^/10

icedid 861670232 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

861670232

C2

provokordino.space

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/684-61-0x00000000002B0000-0x00000000002B7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

684 regsvr32.exe
684 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cf043f2d4c073eed412785bc432c8818.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-60-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

Filesize
8KB

Download
memory/684-61-0x00000000002B0000-0x00000000002B7000-memory.dmp

Filesize
28KB

Download