icedid | 4f0950ffbf865d916ccdfcce9cd69fca93b33225c92b23b8ca948137ea28fa66 | Triage

Analysis

max time kernel
137s
max time network
143s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-02-2022 09:48

Sharing

Report Analysis Logs

General

Target

4f0950ffbf865d916ccdfcce9cd69fca93b33225c92b23b8ca948137ea28fa66.dll
Size

490KB
MD5

8fe8de6b9bbd54ce2ceb99ccff7d50ad
SHA1

d903c898fe86cac05403a2b12fc61da9b315d3b5
SHA256

4f0950ffbf865d916ccdfcce9cd69fca93b33225c92b23b8ca948137ea28fa66
SHA512

499cc1315e2c2708a19bbcd5157c47ace6cbb95c7748890383243b5aa657e2b1b41859c8bc16839696d504eeeaebb9310b7baac9eef0726fc6f6890ecb51e457

Score

10^/10

icedid 3467965077 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1516 regsvr32.exe
1516 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4f0950ffbf865d916ccdfcce9cd69fca93b33225c92b23b8ca948137ea28fa66.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-114-0x00000000028F0000-0x00000000028FE000-memory.dmp

Filesize
56KB

Download