icedid | db5cabe22595607a408fa30bdf288c0992bff836d2e62f6de98d8757f9805e9b | Triage

Analysis

max time kernel
52s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
21-03-2022 19:29

Sharing

Report Analysis Logs

General

Target

dart.dll
Size

148KB
MD5

b20d49ba5d4c4a6e089b895de8949279
SHA1

8f23d9a24ba792706ca19d633f6a925e311670d6
SHA256

db5cabe22595607a408fa30bdf288c0992bff836d2e62f6de98d8757f9805e9b
SHA512

7c45c6565e9e55e9473c707c2001459140016d4133cba5df5083961d6b93d3756ee4a239be5d4c25aa22351f713fb3b564397994d7124a624358f2fbe7e4a540

Score

10^/10

icedid 3546287305 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3546287305

C2

oceriesfornot.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1516 regsvr32.exe
1516 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dart.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-130-0x0000000180000000-0x000000018000B000-memory.dmp

Filesize
44KB

Download