icedid | 11d326c72db2ffdf2782332288e4934a5e9001691bb99c1cccd6d6f1cee92827 | Triage

Analysis

max time kernel
136s
max time network
140s
platform
windows10_x64
resource
win10v20210408
submitted
12-05-2021 15:25

Sharing

Report Analysis Logs

General

Target

11d326c72db2ffdf2782332288e4934a5e9001691bb99c1cccd6d6f1cee92827.dll
Size

55KB
MD5

96c6bc8ddd5ec086fc3212ec8a7ac1ce
SHA1

55d15744bca1b05b3f8a6cb8fd9065b92aa1b448
SHA256

11d326c72db2ffdf2782332288e4934a5e9001691bb99c1cccd6d6f1cee92827
SHA512

2deaa4766c7f7443989f33ff466318eb8ea94e7447ff1aa365a741629c62a0c5b4b669e459467f93dd7bb0545779ca0c6c4c0c34146cbbcf0325eba785eb7087

Score

10^/10

icedid 704617075 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

704617075

C2

icouldmakeyoubelieve.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

776 regsvr32.exe
776 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\11d326c72db2ffdf2782332288e4934a5e9001691bb99c1cccd6d6f1cee92827.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-114-0x0000000001500000-0x000000000155B000-memory.dmp

Filesize
364KB

Download