icedid | f5d8d8d0235b9b71e88297f00acf6ea2277b1e8662a7fa8d17c1a6c535f9e351 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-en-20211014
submitted
06-11-2021 15:15

Sharing

Report Analysis Logs

General

Target

3171.dll
Size

82KB
MD5

c6d828d2dbb3bce4e2e9b8da097aed49
SHA1

8240e681a6e5836d8961c9e8ec72f4bacec6d685
SHA256

f5d8d8d0235b9b71e88297f00acf6ea2277b1e8662a7fa8d17c1a6c535f9e351
SHA512

61026e0d8d3bde40fc54b4a7fb701afe032a392d5aa0bac539ca9f6fb2eba5ddebbb1e295284ddb397ecda76ecb279bc8cde1949c346445b1eb5a54fb3b3679d

Score

10^/10

icedid 3055572094 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3055572094

C2

actuallyobligat.ink

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1836 regsvr32.exe
1836 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3171.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-55-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Filesize
8KB

Download
memory/1836-56-0x0000000001E10000-0x0000000001E73000-memory.dmp

Filesize
396KB

Download