icedid | 7303f3bfc0eac906a8f35b5ab8a9dad4cc821bcb7da7d15216ffeeed7e039234 | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows10_x64
resource
win10-en-20211104
submitted
30-11-2021 13:09

Sharing

Report Analysis Logs

General

Target

7303F3BFC0EAC906A8F35B5AB8A9DAD4CC821BCB7DA7D.dll
Size

277KB
MD5

bbdc55193abbd98a82653f2e84e25a0e
SHA1

cc45f61020e3d7415f215278660b0379826dc0d4
SHA256

7303f3bfc0eac906a8f35b5ab8a9dad4cc821bcb7da7d15216ffeeed7e039234
SHA512

142d15fe546057d0ec3b42461a68f251729319dd27caf7c83c2a3094e4c791caa77d2256cb09a5b1314ec353d7895c14bae6e14fe66b823656b9106421fef279

Score

10^/10

icedid 93330570 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

93330570

C2

illioredesazerro.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3056 regsvr32.exe
3056 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7303F3BFC0EAC906A8F35B5AB8A9DAD4CC821BCB7DA7D.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-118-0x00000000022B0000-0x00000000022FD000-memory.dmp

Filesize
308KB

Download