icedid | 344c6aed9945a611ec6e8dba62e7c0c4a0bd8ef573acde4498ee946dc5ab0d9a | Triage

Analysis

max time kernel
87s
max time network
101s
platform
windows7_x64
resource
win7v20210408
submitted
11-05-2021 10:36

Sharing

Report Analysis Logs

General

Target

344c6aed9945a611ec6e8dba62e7c0c4a0bd8ef573acde4498ee946dc5ab0d9a.dll
Size

231KB
MD5

ec44edc07b4a918d8066e51a086a433b
SHA1

7f502df0e3bbb3bad9ace7569c9a1fa61eb16bd2
SHA256

344c6aed9945a611ec6e8dba62e7c0c4a0bd8ef573acde4498ee946dc5ab0d9a
SHA512

6b93c7d8dc0e03e33f03066f2d9057e7b3643632b6b9ec770489ecc2d042781846de6fbd56b74149a0fc326299b63f8ca08e707c004fdf651d4c5565e21b2b24

Score

10^/10

icedid 1640767800 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1640767800

C2

jikkiaderwa.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1840 regsvr32.exe
1840 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\344c6aed9945a611ec6e8dba62e7c0c4a0bd8ef573acde4498ee946dc5ab0d9a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-59-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download
memory/1840-60-0x0000000000150000-0x0000000000196000-memory.dmp

Filesize
280KB

Download