icedid | ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0 | Triage

Resubmissions

28-07-2021 10:21

210728-47rr4fbrl2 10

20-05-2021 22:30

210520-jb29avnrae 10

06-04-2021 09:24

210406-3zhhrb3h12 10

Analysis

max time kernel
275s
max time network
307s
platform
windows7_x64
resource
win7v20210410
submitted
28-07-2021 10:21

Sharing

Report Analysis Logs

General

Target

ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
Size

63KB
MD5

fcb6cf720c45b554c5f689fa914ffd2c
SHA1

4d247be7e4c3ee51c026c49dc4b9f59479e8ca77
SHA256

ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0
SHA512

a27fb5b32662f0624be8b96aaab8e8b09933dee0c996009970d8f7348d5df2142eb23f9215c35c95640a767399dce4636122dc81e58b5cc15ff3ffa3a6a86514

Score

10^/10

icedid 2608516171 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

2608516171

C2

234willkids.uno

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
suricata: ET MALWARE Win32/IcedID Requesting Encoded Binary M4
suricata

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral1/memory/1820-60-0x0000000000130000-0x0000000000137000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1820	regsvr32.exe
1820	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1820-59-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/1820-60-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download