icedid | 632f92e0ce6fd4ffd7efc36d38f649d98a6e132f43b0f697601ae4c07c3c9480 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
06-07-2022 23:55

Sharing

Report Analysis Logs

General

Target

632f92e0ce6fd4ffd7efc36d38f649d98a6e132f43b0f697601ae4c07c3c9480.dll
Size

13KB
MD5

3edd8e5fb3a051fa54d9ab789dcf53e6
SHA1

9ea9d33148b7fcd7fae5132ccb114d636b0b9d45
SHA256

632f92e0ce6fd4ffd7efc36d38f649d98a6e132f43b0f697601ae4c07c3c9480
SHA512

1562bcac0f17287cda0728f3100ca57acb93b28c854a7a33b48ff0f1ab667c951c8504c6fa3993e6c50487d2b17d90558793cf7066e7140bad4331667dcea71d

Score

10^/10

icedid 4105767744 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

4105767744

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1008 regsvr32.exe
1008 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\632f92e0ce6fd4ffd7efc36d38f649d98a6e132f43b0f697601ae4c07c3c9480.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-54-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download