icedid | b1ae2a431dca469e8f67d646f0b5ccde3aaec6c6c5e46a1acb73a9d87029bb58 | Triage

Analysis

max time kernel
89s
max time network
129s
platform
windows7_x64
resource
win7-20220414-en
submitted
09-05-2022 19:45

Sharing

Report Analysis Logs

General

Target

bec6dc7f7bfbded59d1a9290105e13ac91cf676ef5a4513bacbfcabf73630202.dll
Size

257KB
MD5

af697f43c96aca94907041dd0991b71b
SHA1

697576f25218f729337e7a40adbf374c2cae3566
SHA256

bec6dc7f7bfbded59d1a9290105e13ac91cf676ef5a4513bacbfcabf73630202
SHA512

307058b19495a87541d2e5e3a35f47f806f9eaed63b3cf2f85ae6c7e0cbc27cef90fb9f9c4727ed27dd8bc9f5f104dfe1cf2e66d1830423451f7b46fae404f63

Score

10^/10

icedid 3840329038 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3840329038

C2

hdtrenity.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1972 regsvr32.exe
1972 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bec6dc7f7bfbded59d1a9290105e13ac91cf676ef5a4513bacbfcabf73630202.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-54-0x000007FEFC221000-0x000007FEFC223000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x0000000000180000-0x0000000000189000-memory.dmp

Filesize
36KB

Download
memory/1972-56-0x0000000000180000-0x0000000000189000-memory.dmp

Filesize
36KB

Download
memory/1972-57-0x0000000000180000-0x0000000000189000-memory.dmp

Filesize
36KB

Download