icedid | 901eef4fca3531fab4b13cf0f9208bbc5010640ed0bcd8b78e40e1737e5b30c3 | Triage

Analysis

max time kernel
143s
max time network
148s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-02-2022 09:48

Sharing

Report Analysis Logs

General

Target

901eef4fca3531fab4b13cf0f9208bbc5010640ed0bcd8b78e40e1737e5b30c3.dll
Size

490KB
MD5

73f869024757fa13d98daf967da98e55
SHA1

13943b68dbd62b4d40860409f1665f6c2b06cf13
SHA256

901eef4fca3531fab4b13cf0f9208bbc5010640ed0bcd8b78e40e1737e5b30c3
SHA512

37ca199bf0d0c952d93e5ebc66115f6b3dd277f0af75def3c7319b6a4199c05587d5e0872ffef2350fb63753e953f61eb9107bb4035289c25e379dfeeebe99ff

Score

10^/10

icedid 3467965077 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1648 regsvr32.exe
1648 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\901eef4fca3531fab4b13cf0f9208bbc5010640ed0bcd8b78e40e1737e5b30c3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-114-0x0000000002C20000-0x0000000002C2E000-memory.dmp

Filesize
56KB

Download