icedid | 5b8ad88dcdeaab887007c06eac46b38f8a36165f144b3a8b383dd154594e933b | Triage

Analysis

max time kernel
7s
max time network
14s
platform
windows7_x64
resource
win7v20210408
submitted
06-05-2021 19:06

Sharing

Report Analysis Logs

General

Target

5b8ad88dcdeaab887007c06eac46b38f8a36165f144b3a8b383dd154594e933b.dll
Size

234KB
MD5

8ae6c114f166c8a2cd94b76baad829b5
SHA1

7b0f86d06abccaa983f45cb59f8beaf3db4cb454
SHA256

5b8ad88dcdeaab887007c06eac46b38f8a36165f144b3a8b383dd154594e933b
SHA512

40fda8e9bfb702e5f66e5d1975db0766a279c73a559a01b0f0c4ec39aba1de65f1705cb6ba50c9730c7ad5eabdc655bd2caac43a1cb189b3c96bd6944b406572

Score

10^/10

icedid 3042509645 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3042509645

C2

dsedertyhuiokle.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

980 regsvr32.exe
980 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5b8ad88dcdeaab887007c06eac46b38f8a36165f144b3a8b383dd154594e933b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-60-0x000007FEFBBB1000-0x000007FEFBBB3000-memory.dmp

Filesize
8KB

Download
memory/980-61-0x00000000001C0000-0x0000000000206000-memory.dmp

Filesize
280KB

Download