icedid | 0085b9f4536d96dafb67cb2293662f607266ae5da53d39249bad772ce2766268 | Triage

Resubmissions

20-05-2021 16:37

210520-5rqy5vsltx 10

19-05-2021 21:01

210519-93e2p5lrpa 10

Analysis

max time kernel
92s
max time network
123s
platform
windows10_x64
resource
win10v20210410
submitted
20-05-2021 16:37

Sharing

Report Analysis Logs

General

Target

0085b9f4536d96dafb67cb2293662f607266ae5da53d3.dll
Size

40KB
MD5

5a043575411015d76f638a4d13e32300
SHA1

b74e5a0190456aea96fc51787ad41df8ed804666
SHA256

0085b9f4536d96dafb67cb2293662f607266ae5da53d39249bad772ce2766268
SHA512

a9e740ccebe42d9f9662417078135f15d8701e15b6dfd930bca202365b3328c70ad42aa51d3de4cbb2672a6f1969aa3ee4f50c3bfa4db4b7a9710338675ad9b7

Score

10^/10

icedid 632457322 Photoloader banker trojan

Malware Config

Extracted

Family

icedid

Campaign

632457322

C2

kickersflyers.bid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

PhotoLoader Payload 1 IoCs

IcedID downloder-Photloader.

Processes:

resource	yara_rule
behavioral2/memory/3904-114-0x0000000002450000-0x00000000024AB000-memory.dmp	crime_win32_icedid_stage1

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3904 regsvr32.exe
3904 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0085b9f4536d96dafb67cb2293662f607266ae5da53d3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3904-114-0x0000000002450000-0x00000000024AB000-memory.dmp

Filesize
364KB

Download