icedid | cad3436d1b162c61aa1b67b0e7b5b7f76f20d0e3487c2f0b8e09d28da7acc792 | Triage

Analysis

max time kernel
7s
max time network
13s
platform
windows7_x64
resource
win7v20210408
submitted
07-05-2021 07:03

Sharing

Report Analysis Logs

General

Target

cad3436d1b162c61aa1b67b0e7b5b7f76f20d0e3487c2.dll
Size

231KB
MD5

c76e81e24a5d7b87e10c6431eef104a8
SHA1

54edc4be089ae61a43d9a9c6408d489f219bea7b
SHA256

cad3436d1b162c61aa1b67b0e7b5b7f76f20d0e3487c2f0b8e09d28da7acc792
SHA512

de6e903c5f4a67f1d91296309cee8c0296df1ace4b7c1e1ccdecd2b08d20c3c8281f0b623f1d45852bed174eb559033ee16e0e0645cd17c806a2b61707c6afc8

Score

10^/10

icedid 1640767800 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1640767800

C2

jikkiaderwa.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1080 regsvr32.exe
1080 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cad3436d1b162c61aa1b67b0e7b5b7f76f20d0e3487c2.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-60-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/1080-61-0x0000000000410000-0x0000000000456000-memory.dmp

Filesize
280KB

Download