icedid | 173789e9cb17726e1fa3c0df123cf93a8d4a4cc1318e000b23845ac12ff51953 | Triage

Analysis

max time kernel
147s
max time network
151s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-02-2022 09:48

Sharing

Report Analysis Logs

General

Target

173789e9cb17726e1fa3c0df123cf93a8d4a4cc1318e000b23845ac12ff51953.dll
Size

490KB
MD5

3f01db35b321217a981f146dcef7e9c2
SHA1

892ccd1250440d27e9bbaaa56cb0ed1c2e8f90d1
SHA256

173789e9cb17726e1fa3c0df123cf93a8d4a4cc1318e000b23845ac12ff51953
SHA512

2b4e8c751c4dceda33339a6d5289a6834208c7d8dd6d5e6011e09cbd0a6766abdbb7df0f8f8fb096547dea43a6b0e47eba78592e6f6bab54800180a3803c0489

Score

10^/10

icedid 3467965077 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1816 regsvr32.exe
1816 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\173789e9cb17726e1fa3c0df123cf93a8d4a4cc1318e000b23845ac12ff51953.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-114-0x0000000002A20000-0x0000000002A2E000-memory.dmp

Filesize
56KB

Download