Overview

overview

10

Static

static

10

0a497cdeb92189...ed.dll

windows7_x64

10

0a497cdeb92189...ed.dll

windows10-2004_x64

10
General
Target

0a497cdeb92189e1611c15669897de70e8aed2be2484346686252bea387abfa4_unpacked.dll

Filesize

13KB

Completed

20-05-2022 16:55

Task

behavioral1

Score
10/10
MD5

399e402d426f0675ffcc8efa609421a8

SHA1

2a2e5b9bf49aca783574fcc2aa4a06dcb609a4c1

SHA256

42605a1640895ba3d64833f8fc077c074710b142fcb0332607af8560feb64a24

SHA512

8b70160e6062d1349e5d6fef9d2b73c12f1ddfa01aa6c7eb4735b614fa6d34c225ea2b5aa52be0c9c01af07bba9f5a2f44809a99186b5fe69ff1488c398b7702

Malware Config

Extracted

Family

icedid
Campaign

3118344709
Signatures 3

Filter: none

  • IcedID, BokBot

    Description

    IcedID is a banking trojan capable of stealing credentials.

    Tags

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    Description

    suricata: ET MALWARE Win32/IcedID Request Cookie

    Tags

  • Suspicious behavior: EnumeratesProcesses
    regsvr32.exe

    Reported IOCs

    pidprocess
    852regsvr32.exe
    852regsvr32.exe
Processes 1
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0a497cdeb92189e1611c15669897de70e8aed2be2484346686252bea387abfa4_unpacked.dll
    Suspicious behavior: EnumeratesProcesses
    PID:852
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/852-54-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmp

                            Download