icedid | ce09fe9cabe24b428d25c62c62e935e21e3b46ab841c86fb95112c7b36909999 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 20:22

Sharing

Report Analysis Logs

General

Target

wobip7.dll
Size

266KB
MD5

d3c2536718a9c01de4b342d7df078a8f
SHA1

3692cedf86418c6c3eb4103dade770b3cd959c11
SHA256

4ace9341d54889255357c295e5dc4d70a06fb7e7c8ef781611f497d9efb4f6e9
SHA512

a8569546024bb0297d698e04ba30228088d83cb29304ce30d42e10b3cb2a9edfcc124fda2a581469223ec946a024fc2b894171de4144c72d0ccfa2180781e81a
SSDEEP

3072:UAul+evuRIkFmNLKza8iT3GRwSJnyWHUF1zlLj1ainih14vMJFHOd/TY8QXiryht:UPlK4QaDL0DsYKlqBN00dP

Score

10^/10

icedid 1892568649 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1892568649

C2

normyils.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	regsvr32.exe
2100	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wobip7.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-0-0x0000000000140000-0x00000000001A3000-memory.dmp

Filesize
396KB

Download
memory/2100-1-0x0000000000140000-0x00000000001A3000-memory.dmp

Filesize
396KB

Download