icedid | 1b859320d60949c6d234e19ec3f62ccaa115737f5410ecfeaffc3d3352afb3cc | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows10_x64
resource
win10v20210410
submitted
12-05-2021 16:01

Sharing

Report Analysis Logs

General

Target

595e3339_by_Libranalysis.dll
Size

40KB
MD5

595e333934f7d940aeca741dd93e31cb
SHA1

294121d85a07f7443668606813ae9301ba3984e9
SHA256

1b859320d60949c6d234e19ec3f62ccaa115737f5410ecfeaffc3d3352afb3cc
SHA512

6f73a6a2b645a716c3807b9e3374a12cd4f9098ca4792ea5a475e98b7f338ac1ba631f32f2ade2c30126c6e737888fd0dfdb8a53910066502290f55336b59e59

Score

10^/10

icedid 2857955836 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

2857955836

C2

wasthuliok.live

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4084 regsvr32.exe
4084 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\595e3339_by_Libranalysis.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4084-114-0x0000000002340000-0x000000000239B000-memory.dmp

Filesize
364KB

Download