icedid | cad3436d1b162c61aa1b67b0e7b5b7f76f20d0e3487c2f0b8e09d28da7acc792 | Triage

Resubmissions

12-05-2021 09:57

210512-djr6pq59le 10

11-05-2021 10:36

210511-dsaeprdf1a 10

Analysis

max time kernel
82s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
11-05-2021 10:36

Sharing

Report Analysis Logs

General

Target

cad3436d1b162c61aa1b67b0e7b5b7f76f20d0e3487c2f0b8e09d28da7acc792.dll
Size

231KB
MD5

c76e81e24a5d7b87e10c6431eef104a8
SHA1

54edc4be089ae61a43d9a9c6408d489f219bea7b
SHA256

cad3436d1b162c61aa1b67b0e7b5b7f76f20d0e3487c2f0b8e09d28da7acc792
SHA512

de6e903c5f4a67f1d91296309cee8c0296df1ace4b7c1e1ccdecd2b08d20c3c8281f0b623f1d45852bed174eb559033ee16e0e0645cd17c806a2b61707c6afc8

Score

10^/10

icedid 1640767800 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1640767800

C2

jikkiaderwa.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2840 regsvr32.exe
2840 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cad3436d1b162c61aa1b67b0e7b5b7f76f20d0e3487c2f0b8e09d28da7acc792.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-114-0x0000000002D00000-0x0000000002D46000-memory.dmp

Filesize
280KB

Download