icedid | 42605a1640895ba3d64833f8fc077c074710b142fcb0332607af8560feb64a24 | Triage

Analysis

max time kernel
146s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 16:52

Sharing

Report Analysis Logs

General

Target

0a497cdeb92189e1611c15669897de70e8aed2be2484346686252bea387abfa4_unpacked.dll
Size

13KB
MD5

399e402d426f0675ffcc8efa609421a8
SHA1

2a2e5b9bf49aca783574fcc2aa4a06dcb609a4c1
SHA256

42605a1640895ba3d64833f8fc077c074710b142fcb0332607af8560feb64a24
SHA512

8b70160e6062d1349e5d6fef9d2b73c12f1ddfa01aa6c7eb4735b614fa6d34c225ea2b5aa52be0c9c01af07bba9f5a2f44809a99186b5fe69ff1488c398b7702

Score

10^/10

icedid 3118344709 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3118344709

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3356 regsvr32.exe
3356 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0a497cdeb92189e1611c15669897de70e8aed2be2484346686252bea387abfa4_unpacked.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...