icedid | 0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8

Submit
Reports

Overview

overview

Static

static

0297bbb0f0...ee.exe

windows10-1703-x64

15aeb8380c...71.exe

windows10-1703-x64

1820a0542f...34.dll

windows10-1703-x64

1df11bc19a...ad.exe

windows10-1703-x64

22934e006b...e7.exe

windows10-1703-x64

24989d884f...b7.exe

windows10-1703-x64

2828fabf39...65.dll

windows10-1703-x64

32b0fbaf95...08.exe

windows10-1703-x64

4bf2dace8a...d7.exe

windows10-1703-x64

55d03f9954...44.dll

windows10-1703-x64

5e58e3818a...cb.exe

windows10-1703-x64

611cf2be67...47.exe

windows10-1703-x64

654e574fb4...01.exe

windows10-1703-x64

6f4ac0da34...a5.exe

windows10-1703-x64

$PLUGINSDI...em.dll

windows10-1703-x64

$PLUGINSDIR/UAC.dll

windows10-1703-x64

$PLUGINSDI...fo.dll

windows10-1703-x64

$PLUGINSDI...gs.dll

windows10-1703-x64

$PROGRAMFI...it.dll

windows10-1703-x64

$PROGRAMFI...ge.dll

windows10-1703-x64

$PROGRAMFI...er.dll

windows10-1703-x64

7109e67cf6...58.exe

windows10-1703-x64

71e2483b2d...4e.dll

windows10-1703-x64

79fb1d00ef...00.exe

windows10-1703-x64

7ef9667e73...98.exe

windows10-1703-x64

8264e723a4...9d.exe

windows10-1703-x64

8427f4aaf2...96.exe

windows10-1703-x64

863c612734...af.exe

windows10-1703-x64

91eab57eaf...d8.exe

windows10-1703-x64

942263c895...38.exe

windows10-1703-x64

95193266e3...fc.exe

windows10-1703-x64

99db2e7287...4e.exe

windows10-1703-x64

Resubmissions

04-10-2024 16:44

27-09-2024 16:54

27-09-2024 16:44

04-08-2024 18:04

03-08-2024 17:26

03-08-2024 16:14

03-08-2024 15:52

31-07-2024 19:40

31-07-2024 10:53

Analysis

max time kernel
661s
max time network
667s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
31-07-2024 19:40

Sharing

Copy URL

Twitter E-mail

Static task

static1

9 signatures

Behavioral task

behavioral1

Sample

0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe

Resource

win10-20240404-en

discovery

windows10-1703-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe

Resource

win10-20240404-en

smokeloader backdoor discovery trojan

windows10-1703-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll

Resource

win10-20240404-en

icedid 1910897067 banker loader trojan

windows10-1703-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe

Resource

win10-20240404-en

upx

windows10-1703-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe

Resource

win10-20240404-en

discovery

windows10-1703-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe

Resource

win10-20240404-en

danabot 4 banker discovery trojan

windows10-1703-x64

6 signatures

150 seconds

Behavioral task

behavioral7

Sample

2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.dll

Resource

win10-20240404-en

windows10-1703-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe

Resource

win10-20240404-en

djvu discovery persistence ransomware

windows10-1703-x64

12 signatures

150 seconds

Behavioral task

behavioral9

Sample

4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe

Resource

win10-20240611-en

djvu discovery persistence ransomware

windows10-1703-x64

12 signatures

150 seconds

Behavioral task

behavioral10

Sample

55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.dll

Resource

win10-20240404-en

icedid 1677747888 banker loader trojan

windows10-1703-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe

Resource

win10-20240404-en

lokibot collection credential_access discovery spyware stealer trojan

windows10-1703-x64

13 signatures

150 seconds

Behavioral task

behavioral12

Sample

611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe

Resource

win10-20240404-en

stormkitty credential_access discovery persistence privilege_escalation spyware stealer

windows10-1703-x64

15 signatures

150 seconds

Behavioral task

behavioral13

Sample

654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe

Resource

win10-20240404-en

discovery

windows10-1703-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe

Resource

win10-20240404-en

discovery evasion persistence themida trojan

windows10-1703-x64

20 signatures

150 seconds

Behavioral task

behavioral15

Sample

$PLUGINSDIR/System.dll

Resource

win10-20240611-en

discovery

windows10-1703-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

$PLUGINSDIR/UAC.dll

Resource

win10-20240404-en

discovery

windows10-1703-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win10-20240404-en

discovery

windows10-1703-x64

3 signatures

150 seconds

Behavioral task

behavioral18

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10-20240404-en

discovery

windows10-1703-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

$PROGRAMFILES/foler/olader/acledit.dll

Resource

win10-20240404-en

discovery

windows10-1703-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

$PROGRAMFILES/foler/olader/acppage.dll

Resource

win10-20240404-en

discovery

windows10-1703-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

$PROGRAMFILES/foler/olader/adprovider.dll

Resource

win10-20240611-en

discovery

windows10-1703-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

7109e67cf655b41ff88903bf1e70cc4efa3e537a38df7df90d8a3ff95c4cab58.exe

Resource

win10-20240404-en

trickbot top148 banker discovery trojan

windows10-1703-x64

8 signatures

150 seconds

Behavioral task

behavioral23

Sample

71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll

Resource

win10-20240404-en

qakbot tr02 1607427512 banker discovery stealer trojan

windows10-1703-x64

9 signatures

150 seconds

Behavioral task

behavioral24

Sample

79fb1d00ef9d85e958a17fd331b23dec507e4f2e2c150fd580d0668b84d29d00.exe

Resource

win10-20240404-en

windows10-1703-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98.exe

Resource

win10-20240404-en

windows10-1703-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

8264e723a411381a9d837458ec39cbb36c8d582bcba14f7ed7fc45f8154c479d.exe

Resource

win10-20240611-en

discovery

windows10-1703-x64

2 signatures

150 seconds

Behavioral task

behavioral27

Sample

8427f4aaf255d36cf523ecd34f3023e23cb0ad1d5edacc5c96d1f70ff6b1b496.exe

Resource

win10-20240404-en

discovery persistence

windows10-1703-x64

3 signatures

150 seconds

Behavioral task

behavioral28

Sample

863c612734f5ff0ff0ea3fed7fd790dfb43c47eecdc1417bcd82c0ad866419af.exe

Resource

win10-20240404-en

discovery

windows10-1703-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

91eab57eaf00089ffd21329eb93e072c8eb7ed79e37c807f6db2859548c8b5d8.exe

Resource

win10-20240404-en

stormkitty credential_access discovery evasion spyware stealer themida trojan

windows10-1703-x64

12 signatures

150 seconds

Behavioral task

behavioral30

Sample

942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe

Resource

win10-20240404-en

djvu discovery persistence ransomware

windows10-1703-x64

12 signatures

150 seconds

Behavioral task

behavioral31

Sample

95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc.exe

Resource

win10-20240404-en

windows10-1703-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

99db2e72873b64451cbfb76b8402964eea1b84cf0fe9e326507673d5a534c04e.exe

Resource

win10-20240404-en

danabot 4 banker discovery trojan

windows10-1703-x64

6 signatures

150 seconds

Report Analysis Logs

General

Target

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll
Size

38KB
MD5

a4017c06209e16b8f47fcf6e5845aba9
SHA1

66d99a1cc92ed316e0d7a2ab6df466c289154ec3
SHA256

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34
SHA512

52e4df915b3cb6eb60a3f37874b0d8a14646ffadb9aa621cf8ea3fb04b5cbb4250fb9cec3a2ed8722a7eae4b600836b5b7bf72e53e297e464fb844096a9b2f5e
SSDEEP

768:tojIJWP0znqX60+KU6nCVUO2gTjZSXulSJ474fLv/zkSf2Vz:NnqXn+YoQ+lu474zo

Score

10^/10

icedid 1910897067 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1910897067

epicprotovir.download

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4924 regsvr32.exe
4924 regsvr32.exe

pid	process
4924	regsvr32.exe
4924	regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4924-0-0x0000000002890000-0x00000000028EB000-memory.dmp

Filesize
364KB

Download