icedid | 59d6971fe43589ffa87a240ea385e546b6330af33b3cdd49750c1b3addc6bd65 | Triage

Analysis

max time kernel
67s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
07-05-2021 00:32

Sharing

Report Analysis Logs

General

Target

42a5df056229df5e2bf1fec2e475e4c8.dll
Size

43KB
MD5

42a5df056229df5e2bf1fec2e475e4c8
SHA1

7a5b1254bddb42186b765a936a05d7084607e7d7
SHA256

59d6971fe43589ffa87a240ea385e546b6330af33b3cdd49750c1b3addc6bd65
SHA512

c890d4f845e34f24c530116998ba845ee2747e09307fd53543edc300211b874ced1f838fe657a4dc8cbe24a66a355cb2a56acc02e1f328d233a5e7537b9dfc34

Score

10^/10

icedid 1436894865 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1436894865

C2

zasertiokil.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3540 regsvr32.exe
3540 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\42a5df056229df5e2bf1fec2e475e4c8.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3540-114-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download