icedid | 7c0603c5c041fa16c8bd12044555529d725b6144836fda3e7896f4027ed4eb5f | Triage

Analysis

max time kernel
124s
max time network
123s
platform
windows7_x64
resource
win7v20210410
submitted
13-05-2021 10:08

Sharing

Report Analysis Logs

General

Target

11d326c72db2ffdf2782332288e4934a5e9001691bb99c1cccd6d6f1cee92827.exe.dll

Score

10^/10

icedid 704617075 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

704617075

C2

icouldmakeyoubelieve.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1904 regsvr32.exe
1904 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\11d326c72db2ffdf2782332288e4934a5e9001691bb99c1cccd6d6f1cee92827.exe.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-60-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/1904-61-0x00000000001F0000-0x000000000024B000-memory.dmp

Filesize
364KB

Download