icedid | b1ae2a431dca469e8f67d646f0b5ccde3aaec6c6c5e46a1acb73a9d87029bb58 | Triage

Analysis

max time kernel
83s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09-05-2022 19:45

Sharing

Report Analysis Logs

General

Target

bec6dc7f7bfbded59d1a9290105e13ac91cf676ef5a4513bacbfcabf73630202.dll
Size

257KB
MD5

af697f43c96aca94907041dd0991b71b
SHA1

697576f25218f729337e7a40adbf374c2cae3566
SHA256

bec6dc7f7bfbded59d1a9290105e13ac91cf676ef5a4513bacbfcabf73630202
SHA512

307058b19495a87541d2e5e3a35f47f806f9eaed63b3cf2f85ae6c7e0cbc27cef90fb9f9c4727ed27dd8bc9f5f104dfe1cf2e66d1830423451f7b46fae404f63

Score

10^/10

icedid 3840329038 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3840329038

C2

hdtrenity.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2652 regsvr32.exe
2652 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bec6dc7f7bfbded59d1a9290105e13ac91cf676ef5a4513bacbfcabf73630202.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-130-0x0000000000D10000-0x0000000000D19000-memory.dmp

Filesize
36KB

Download