icedid | 71f1c8e85b4187c34451aea70125e7f21759d7e24ada3f74c4d0e6df6d583e4b | Triage

Analysis

max time kernel
129s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
29-05-2022 16:37

Sharing

Report Analysis Logs

General

Target

71F1C8E85B4187C34451AEA70125E7F21759D7E24ADA3.dll
Size

396KB
MD5

47d8aebb46cc914d1eec5c4c917907f8
SHA1

a0f4517f0ad6ffa3e759b7aac338ad901f5457f0
SHA256

71f1c8e85b4187c34451aea70125e7f21759d7e24ada3f74c4d0e6df6d583e4b
SHA512

f1adc18ed42b4a2282315e0dd23d933468626c164bcc48c93183a3353365a7e0258f3140fc0afa87cce9a38d845fa200db10e472ac7a6f44d84690ecc1274cba

Score

10^/10

icedid 4020654167 banker loader suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

4020654167

C2

actuallycost.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4512 regsvr32.exe
4512 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\71F1C8E85B4187C34451AEA70125E7F21759D7E24ADA3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4512-130-0x0000000001F00000-0x0000000001F09000-memory.dmp

Filesize
36KB

Download