icedid | 628701b141bb2b8657346567ccdfee394ef3a62f203f28f9b3e0e46672f3f51e | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows10_x64
resource
win10v20210410
submitted
17-05-2021 18:24

Sharing

Report Analysis Logs

General

Target

628701b141bb2b8657346567ccdfee394ef3a62f203f28f9b3e0e46672f3f51e.dll
Size

40KB
MD5

a5fdc0685ae9779a72467e9bbb784321
SHA1

ca4b1836a18a31d173b493bba255a5464c92b8fc
SHA256

628701b141bb2b8657346567ccdfee394ef3a62f203f28f9b3e0e46672f3f51e
SHA512

10a87c97bb3730d19b2ab6d4c0146de2fb1cba1d06b583d564757b4d531eddf08f07cc78e4bb7d92e221e3e2d54c5ea70577de0668f37614aab6d85125306c31

Score

10^/10

icedid 2958621550 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

2958621550

C2

nonprofitwerde.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1736 regsvr32.exe
1736 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\628701b141bb2b8657346567ccdfee394ef3a62f203f28f9b3e0e46672f3f51e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-114-0x0000000000D00000-0x0000000000D5B000-memory.dmp

Filesize
364KB

Download