icedid | c0a78a67fb141f8c7bc36568849bc848d7e7ad823d40c9910ae3247e610b8fc3 | Triage

Analysis

max time kernel
17s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 14:36

Sharing

Report Analysis Logs

General

Target

3003.dll
Size

78KB
MD5

964a0015332ec2cc13ab12b8d85f29ff
SHA1

cab978169550d6dcb108d1cbb379fa6ca4e6436e
SHA256

c0a78a67fb141f8c7bc36568849bc848d7e7ad823d40c9910ae3247e610b8fc3
SHA512

6e6d81bed1884ddf16922d06b2c0e8b51c9dac2c986d3c88c0e5de2e75d25a28ec6d3551d406bed4e59229623fec895a1c7e3255f66315938f803d0319ec5014
SSDEEP

768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3717128962

C2

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/100-0-0x00000000012F0000-0x00000000012F7000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

100 regsvr32.exe
100 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3003.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/100-0-0x00000000012F0000-0x00000000012F7000-memory.dmp

Filesize
28KB

Download