icedid | 7c0603c5c041fa16c8bd12044555529d725b6144836fda3e7896f4027ed4eb5f | Triage

Analysis

max time kernel
123s
max time network
126s
platform
windows7_x64
resource
win7v20210410
submitted
13-05-2021 09:41

Sharing

Report Analysis Logs

General

Target

11d326c72db2ffdf2782332288e4934a5e9001691bb99c1cccd6d6f1cee92827.exe.dll
Size

55KB
MD5

96c6bc8ddd5ec086fc3212ec8a7ac1ce
SHA1

55d15744bca1b05b3f8a6cb8fd9065b92aa1b448
SHA256

11d326c72db2ffdf2782332288e4934a5e9001691bb99c1cccd6d6f1cee92827
SHA512

2deaa4766c7f7443989f33ff466318eb8ea94e7447ff1aa365a741629c62a0c5b4b669e459467f93dd7bb0545779ca0c6c4c0c34146cbbcf0325eba785eb7087

Score

10^/10

icedid 704617075 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

704617075

C2

icouldmakeyoubelieve.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

296 regsvr32.exe
296 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\11d326c72db2ffdf2782332288e4934a5e9001691bb99c1cccd6d6f1cee92827.exe.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/296-59-0x000007FEFB8F1000-0x000007FEFB8F3000-memory.dmp

Filesize
8KB

Download
memory/296-60-0x00000000002B0000-0x000000000030B000-memory.dmp

Filesize
364KB

Download