icedid | f8eb655b6dc2fab0a8a4fbc3f3b8a7af819e0d7a414de22c9dabaeca2acfcabf | Triage

Analysis

max time kernel
15s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
10-05-2021 17:56

Sharing

Report Analysis Logs

General

Target

e790f0e9d15b6230bfd11a46f84bbd19.dll
Size

51KB
MD5

e790f0e9d15b6230bfd11a46f84bbd19
SHA1

831fd072cb92ce51e13202e7f1292b27ec08d99b
SHA256

f8eb655b6dc2fab0a8a4fbc3f3b8a7af819e0d7a414de22c9dabaeca2acfcabf
SHA512

3dfef4e53dab30d6b8d581d6d2f19564d539d96690243a496297a022560475d11480ccac20fadf1cf27cb22bbb037cf6ffff55687d5f294a75c3d13f755df374

Score

10^/10

icedid 2975399169 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

2975399169

C2

dupperawergo.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1908 regsvr32.exe
1908 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e790f0e9d15b6230bfd11a46f84bbd19.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-114-0x0000000002020000-0x000000000207B000-memory.dmp

Filesize
364KB

Download