icedid | 9f589fe88da77314eee71007ccbe7075023ba8d307a633c49d08141d606e86e8 | Triage

Analysis

max time kernel
154s
max time network
128s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-02-2022 09:48

Sharing

Report Analysis Logs

General

Target

9f589fe88da77314eee71007ccbe7075023ba8d307a633c49d08141d606e86e8.dll
Size

490KB
MD5

1a1a5779657c7f2e8e56f880628a2faa
SHA1

19a72f70228744d21b8ffd68261dc90a424a3054
SHA256

9f589fe88da77314eee71007ccbe7075023ba8d307a633c49d08141d606e86e8
SHA512

cbe0e76a3d72e2ef87c4165375e4883357e94b8295d4939b02d2ee8ac5eee46400f5d86c0eee31dc219aaad2a5c274a18f3a10a52074758ebdaed741c87425d8

Score

10^/10

icedid 3467965077 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4036 regsvr32.exe
4036 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9f589fe88da77314eee71007ccbe7075023ba8d307a633c49d08141d606e86e8.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4036-115-0x0000000000770000-0x000000000077E000-memory.dmp

Filesize
56KB

Download