icedid | cb007f57fb0d428f336b6c8bc3967c48bfb96336adf161905fe71ee16f481f64 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 05:36

Sharing

Report Analysis Logs

General

Target

cb007f57fb0d428f336b6c8bc3967c48bfb96336adf161905fe71ee16f481f64.dll
Size

158KB
MD5

9d6730673c23b9672ab1c32c8b6fb887
SHA1

ab8312c94201779d373a25c4ab38978c8ae6bad0
SHA256

cb007f57fb0d428f336b6c8bc3967c48bfb96336adf161905fe71ee16f481f64
SHA512

9d95000877dd3d7c7db882ce4fcfe0ddfc479d252f3e5459d50bd5c36e9aead03f21b29124c3ef20f3cb1ae52d998d15690085006dc0c202d5ce58ce6dec442d
SSDEEP

3072:FwZDE3irQ+r+4rLczkGq9n7zCXCdFMYNzomk+pt79s2j:firQ+r+2aTq9CyYYNzoN2j

Score

10^/10

icedid 81538452 banker core_loader trojan

Malware Config

Extracted

Family

icedid

Botnet

81538452

C2

garrozalibbo.click

disponfirules.top

mislinororv.top

twistcolseza.top

Attributes

auth_var
8
url_path
/news/

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb007f57fb0d428f336b6c8bc3967c48bfb96336adf161905fe71ee16f481f64.dll
1⤵
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-6-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download
memory/2084-0-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download
memory/2084-5-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download