icedid | dd6d136055296abfc6f94c8ae1d039042c603fb1d0938a75d446c86d1f4636d4 | Triage

Analysis

max time kernel
6s
max time network
25s
platform
windows7_x64
resource
win7v20210408
submitted
11-05-2021 10:36

Sharing

Report Analysis Logs

General

Target

dd6d136055296abfc6f94c8ae1d039042c603fb1d0938a75d446c86d1f4636d4.dll
Size

234KB
MD5

fecf84576b7b6cdc64e5cf839db18c3b
SHA1

32fffb167d3e20a15731cb137dde2fa2fbc1bdf2
SHA256

dd6d136055296abfc6f94c8ae1d039042c603fb1d0938a75d446c86d1f4636d4
SHA512

0c7cdf1e70c085306c89d4e577f3492a427082ce73bede460fb80759d3a3b976ea7f666c19f7871b4283788132bd671135933ce7e561da7eb4eec5e50941da3b

Score

10^/10

icedid 3042509645 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3042509645

C2

dsedertyhuiokle.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1652 regsvr32.exe
1652 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dd6d136055296abfc6f94c8ae1d039042c603fb1d0938a75d446c86d1f4636d4.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-60-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/1652-61-0x00000000001B0000-0x00000000001F6000-memory.dmp

Filesize
280KB

Download