icedid | 4867d16b596ca1ff41e0845d2086f87507917be2779abb7c0dd77e078e3ea66a | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211014
submitted
11-11-2021 16:38

Sharing

Report Analysis Logs

General

Target

f5d8d8d0235b9b71e88297f00acf6ea2277b1e8662a7fa8d17c1a6c535f9e351.dll
Size

82KB
MD5

c6d828d2dbb3bce4e2e9b8da097aed49
SHA1

8240e681a6e5836d8961c9e8ec72f4bacec6d685
SHA256

f5d8d8d0235b9b71e88297f00acf6ea2277b1e8662a7fa8d17c1a6c535f9e351
SHA512

61026e0d8d3bde40fc54b4a7fb701afe032a392d5aa0bac539ca9f6fb2eba5ddebbb1e295284ddb397ecda76ecb279bc8cde1949c346445b1eb5a54fb3b3679d

Score

10^/10

icedid 3055572094 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3055572094

C2

actuallyobligat.ink

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1652 regsvr32.exe
1652 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f5d8d8d0235b9b71e88297f00acf6ea2277b1e8662a7fa8d17c1a6c535f9e351.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-55-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1652-56-0x00000000003B0000-0x0000000000413000-memory.dmp

Filesize
396KB

Download