icedid | 7e2e8eba9f6bf732f3ef3f88634f27eea7fbe9c84dde728554f0b22c07886a8e | Triage

Analysis

max time kernel
144s
max time network
153s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-02-2022 09:48

Sharing

Report Analysis Logs

General

Target

7e2e8eba9f6bf732f3ef3f88634f27eea7fbe9c84dde728554f0b22c07886a8e.dll
Size

490KB
MD5

f34d3f8d78ac72829d060feb43e52158
SHA1

f4475a673fc68aa1bbe35c6b7d20b7980f9f15be
SHA256

7e2e8eba9f6bf732f3ef3f88634f27eea7fbe9c84dde728554f0b22c07886a8e
SHA512

80f36f0a2d0956e1ed780774f6e34bb96d2be330993437fcd099388502568d819fd5137c3ff4dd701b59669508cfc05ee25208f6a57182a3dbe0ebafd0595e67

Score

10^/10

icedid 3467965077 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1724 regsvr32.exe
1724 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7e2e8eba9f6bf732f3ef3f88634f27eea7fbe9c84dde728554f0b22c07886a8e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-115-0x0000000001030000-0x000000000103E000-memory.dmp

Filesize
56KB

Download