icedid | a46d4a8c88eedb7f829d09eed741f8843b76ab28f43b282fa9c5d96f6eab6757 | Triage

Analysis

max time kernel
112s
max time network
117s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-02-2022 09:48

Sharing

Report Analysis Logs

General

Target

a46d4a8c88eedb7f829d09eed741f8843b76ab28f43b282fa9c5d96f6eab6757.dll
Size

490KB
MD5

b577a5d6bca871d3d4826a661eaf53a3
SHA1

e79f0ed34b470eda6c996e0864219f12a9516828
SHA256

a46d4a8c88eedb7f829d09eed741f8843b76ab28f43b282fa9c5d96f6eab6757
SHA512

578e880bc275da4aeabffd4327a18ad4b08b57f6b4430867f21b9fced0548d5345bf686c8917033392b97f0b044d48b9a7743b36f2022e31c64cb52666ae2901

Score

10^/10

icedid 3467965077 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1404 regsvr32.exe
1404 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a46d4a8c88eedb7f829d09eed741f8843b76ab28f43b282fa9c5d96f6eab6757.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-114-0x0000000000DE0000-0x0000000000DEE000-memory.dmp

Filesize
56KB

Download