icedid | 0eccb9598aae0e56658d15c231c193543b417baf480c2fd085c868bc6dacb4a5 | Triage

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-04-2022 10:44

Sharing

Report Analysis Logs

General

Target

sample_0eccb9598aae0e56658d15c231c193543b417baf480c2fd085c868bc6dacb4a5.dll
Size

253KB
MD5

0dc327d0d54f20016c0fa8bced3b1b51
SHA1

df56e19538beca40ea2227ea9c70cbb4f6bf6acc
SHA256

0eccb9598aae0e56658d15c231c193543b417baf480c2fd085c868bc6dacb4a5
SHA512

b902c414796dd512fff64a4b48b57e04b8b6e4256fd5c3c8795f296c13066162a2949c6df303bbe5f2765f39111a6c34223c695204fd61cb488cc80480659299

Score

10^/10

icedid 3840329038 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3840329038

C2

hdtrenity.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

968 regsvr32.exe
968 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\sample_0eccb9598aae0e56658d15c231c193543b417baf480c2fd085c868bc6dacb4a5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-130-0x0000000002700000-0x0000000002709000-memory.dmp

Filesize
36KB

Download