icedid | 2fa82bdf1836fc7f61d09637580ca0ea26f3aed7e59acad9cd7f793148368214 | Triage

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24-06-2022 20:23

Sharing

Report Analysis Logs

General

Target

51ab7bee5c23093e4eed61629dd74f22.dll
Size

13KB
MD5

51ab7bee5c23093e4eed61629dd74f22
SHA1

1a7a730d9e50c373fb0f4ab92cceaf26bfcd3d3c
SHA256

2fa82bdf1836fc7f61d09637580ca0ea26f3aed7e59acad9cd7f793148368214
SHA512

f74624982337a372293d0dac5e48308367841bc755c9950a7aa0110e17f1dd136892791d85cb1f5d5433ece22dca552bfdc3bb2f402fccb0059f86432c1f794d

Score

10^/10

icedid 3289900935 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3289900935

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1280 regsvr32.exe
1280 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\51ab7bee5c23093e4eed61629dd74f22.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...