icedid | 1b859320d60949c6d234e19ec3f62ccaa115737f5410ecfeaffc3d3352afb3cc | Triage

Analysis

max time kernel
11s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
12-05-2021 15:50

Sharing

Report Analysis Logs

General

Target

labyq11.dll
Size

40KB
MD5

595e333934f7d940aeca741dd93e31cb
SHA1

294121d85a07f7443668606813ae9301ba3984e9
SHA256

1b859320d60949c6d234e19ec3f62ccaa115737f5410ecfeaffc3d3352afb3cc
SHA512

6f73a6a2b645a716c3807b9e3374a12cd4f9098ca4792ea5a475e98b7f338ac1ba631f32f2ade2c30126c6e737888fd0dfdb8a53910066502290f55336b59e59

Score

10^/10

icedid 2857955836 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

2857955836

C2

wasthuliok.live

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2208 regsvr32.exe
2208 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\labyq11.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-114-0x0000000002380000-0x00000000023DB000-memory.dmp

Filesize
364KB

Download