icedid | 98b3471ac865e7cc6cc5712ab0db76c476fd861828267284a6aa40c802737b2e | Triage

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23-03-2022 01:08

Sharing

Report Analysis Logs

General

Target

crypted_loader_dll_64Donat_3.dll
Size

148KB
MD5

9441c0354b8f4d484019621afb3036ad
SHA1

36a1361c0685f43dbe11153fbae925fc6d048dcc
SHA256

98b3471ac865e7cc6cc5712ab0db76c476fd861828267284a6aa40c802737b2e
SHA512

8d1bd9eb6065b4320bcc2477249a91bed6f96f6cfd8bc632e90fd4f23b9b3d902333c3707ae294b7fb7c237db95e67f238404ad28bf730fdf186c809b576c6cc

Score

10^/10

icedid 1832122140 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

1832122140

C2

rivertimad.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3616 regsvr32.exe
3616 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\crypted_loader_dll_64Donat_3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3616-134-0x0000000180000000-0x000000018000B000-memory.dmp

Filesize
44KB

Download