icedid | 6557f5eecf1df5c7835d2ed88f99b52503873c6307b946b15d81a1e5a885c87a | Triage

Analysis

max time kernel
152s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-05-2022 21:26

Sharing

Report Analysis Logs

General

Target

6557f5eecf1df5c7835d2ed88f99b52503873c6307b946b15d81a1e5a885c87a.dll
Size

490KB
MD5

ccc7f68d2dbd6801dde30ff57e5c0c2b
SHA1

3899e2803ec9666b17684d1cd42931bb55a8f9e1
SHA256

6557f5eecf1df5c7835d2ed88f99b52503873c6307b946b15d81a1e5a885c87a
SHA512

26c47fec58849d42b107ee9ba7c1b3326aee5339d3865e1d795dff596dc4a1458a480d4dd884306a4e884ef033240c6269cad4461d283cfb9a5bf2d703ce234f

Score

10^/10

icedid 3467965077 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1960 regsvr32.exe
1960 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6557f5eecf1df5c7835d2ed88f99b52503873c6307b946b15d81a1e5a885c87a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-130-0x0000000002C30000-0x0000000002C3E000-memory.dmp

Filesize
56KB

Download