icedid | 0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8

Submit
Reports

Overview

overview

Static

static

0297bbb0f0...ee.exe

windows7-x64

0297bbb0f0...ee.exe

windows10-2004-x64

15aeb8380c...71.exe

windows7-x64

15aeb8380c...71.exe

windows10-2004-x64

1820a0542f...34.dll

windows7-x64

1820a0542f...34.dll

windows10-2004-x64

1df11bc19a...ad.exe

windows7-x64

1df11bc19a...ad.exe

windows10-2004-x64

22934e006b...e7.exe

windows7-x64

22934e006b...e7.exe

windows10-2004-x64

24989d884f...b7.exe

windows7-x64

24989d884f...b7.exe

windows10-2004-x64

2828fabf39...65.dll

windows7-x64

2828fabf39...65.dll

windows10-2004-x64

32b0fbaf95...08.exe

windows7-x64

32b0fbaf95...08.exe

windows10-2004-x64

4bf2dace8a...d7.exe

windows7-x64

4bf2dace8a...d7.exe

windows10-2004-x64

55d03f9954...44.dll

windows7-x64

55d03f9954...44.dll

windows10-2004-x64

5e58e3818a...cb.exe

windows7-x64

5e58e3818a...cb.exe

windows10-2004-x64

611cf2be67...47.exe

windows7-x64

611cf2be67...47.exe

windows10-2004-x64

654e574fb4...01.exe

windows7-x64

654e574fb4...01.exe

windows10-2004-x64

6f4ac0da34...a5.exe

windows7-x64

6f4ac0da34...a5.exe

windows10-2004-x64

$PLUGINSDI...em.dll

windows7-x64

$PLUGINSDI...em.dll

windows10-2004-x64

$PLUGINSDI...gs.dll

windows7-x64

$PLUGINSDI...gs.dll

windows10-2004-x64

Resubmissions

04-10-2024 16:44

27-09-2024 16:54

27-09-2024 16:44

04-08-2024 18:04

03-08-2024 17:26

03-08-2024 16:14

03-08-2024 15:52

31-07-2024 19:40

31-07-2024 10:53

Analysis

max time kernel
121s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 17:26

Sharing

Copy URL

Twitter E-mail

Static task

static1

9 signatures

Behavioral task

behavioral1

Sample

0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe

Resource

win7-20240708-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe

Resource

win7-20240705-en

smokeloader backdoor discovery trojan

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe

Resource

win10v2004-20240802-en

smokeloader backdoor discovery trojan

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral5

Sample

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll

Resource

win7-20240708-en

icedid 1910897067 banker loader trojan

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll

Resource

win10v2004-20240802-en

icedid 1910897067 banker loader trojan

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe

Resource

win7-20240729-en

upx

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe

Resource

win10v2004-20240802-en

upx

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe

Resource

win7-20240708-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe

Resource

win7-20240704-en

danabot 4 banker discovery trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral12

Sample

24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe

Resource

win10v2004-20240802-en

danabot 4 banker discovery trojan

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral13

Sample

2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.dll

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe

Resource

win7-20240729-en

djvu discovery persistence ransomware

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral16

Sample

32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe

Resource

win10v2004-20240802-en

djvu discovery persistence ransomware

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral17

Sample

4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe

Resource

win7-20240705-en

djvu discovery persistence ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral18

Sample

4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe

Resource

win10v2004-20240802-en

djvu discovery persistence ransomware

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral19

Sample

55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.dll

Resource

win7-20240708-en

icedid 1677747888 banker loader trojan

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.dll

Resource

win10v2004-20240802-en

icedid 1677747888 banker loader trojan

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe

Resource

win7-20240705-en

lokibot collection credential_access discovery spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral22

Sample

5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe

Resource

win10v2004-20240802-en

lokibot collection credential_access discovery spyware stealer trojan

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral23

Sample

611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe

Resource

win7-20240704-en

stormkitty credential_access discovery persistence privilege_escalation spyware stealer

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral24

Sample

611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe

Resource

win10v2004-20240802-en

stormkitty credential_access discovery persistence privilege_escalation spyware stealer

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral25

Sample

654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe

Resource

win7-20240708-en

discovery

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe

Resource

win7-20240708-en

discovery evasion themida trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral28

Sample

6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe

Resource

win10v2004-20240802-en

discovery evasion themida trojan

windows10-2004-x64

19 signatures

150 seconds

Behavioral task

behavioral29

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240708-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral30

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win7-20240708-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral32

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll
Size

38KB
MD5

a4017c06209e16b8f47fcf6e5845aba9
SHA1

66d99a1cc92ed316e0d7a2ab6df466c289154ec3
SHA256

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34
SHA512

52e4df915b3cb6eb60a3f37874b0d8a14646ffadb9aa621cf8ea3fb04b5cbb4250fb9cec3a2ed8722a7eae4b600836b5b7bf72e53e297e464fb844096a9b2f5e
SSDEEP

768:tojIJWP0znqX60+KU6nCVUO2gTjZSXulSJ474fLv/zkSf2Vz:NnqXn+YoQ+lu474zo

Score

10^/10

icedid 1910897067 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1910897067

epicprotovir.download

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4632 regsvr32.exe
4632 regsvr32.exe

pid	process
4632	regsvr32.exe
4632	regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4632-0-0x00000000029D0000-0x0000000002A2B000-memory.dmp

Filesize
364KB

Download