Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-05-2021 10:36

General

  • Target

    9beb1b3b4e8b86c245f0088e5aaef7a123650668607ecdf48ffe7aeedfb2a592.dll

  • Size

    238KB

  • MD5

    ebc29bb061f9aa3731321a5c59d8eae9

  • SHA1

    9351adf8d8ba4230093ef8e508c7790ecea7ff9a

  • SHA256

    9beb1b3b4e8b86c245f0088e5aaef7a123650668607ecdf48ffe7aeedfb2a592

  • SHA512

    d1f3803ec0ce930ef54f0e8cbecf7855a7865c7660d1f43f8a3b304886f3977a7df701bbe359a72b417f6611cd9603c58579bab580b041ed140f7f06c4de5574

Malware Config

Extracted

Family

icedid

Campaign

3042509645

C2

dsedertyhuiokle.top

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9beb1b3b4e8b86c245f0088e5aaef7a123650668607ecdf48ffe7aeedfb2a592.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/808-114-0x0000000002BF0000-0x0000000002C36000-memory.dmp
    Filesize

    280KB