icedid | 235b4aef916cfe2b8c63778d22b79340d96bfa09354f6d755f4e78cc7149509f | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7v20210410
submitted
07-05-2021 14:51

Sharing

Report Analysis Logs

General

Target

235b4aef916cfe2b8c63778d22b79340d96bfa09354f6.dll
Size

238KB
MD5

f89aa09b4ecdb7196d88b48e490a3501
SHA1

f456fa2b6682925f535c59ae5587361f59f69d08
SHA256

235b4aef916cfe2b8c63778d22b79340d96bfa09354f6d755f4e78cc7149509f
SHA512

5e409e9ab58701ecd392563e1f3b8285d4943cc2961f40a13ca119d54f0516b8ec4f34295b1afec51a3ad23d71c6a95339a29a5532084d3e9704d72eb5791981

Score

10^/10

icedid 3042509645 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3042509645

C2

barcafokliresd.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1040 regsvr32.exe
1040 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\235b4aef916cfe2b8c63778d22b79340d96bfa09354f6.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-59-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1040-60-0x0000000000460000-0x00000000004A6000-memory.dmp

Filesize
280KB

Download