icedid | 815df99c15d3431db3e018aad2827a816d078063fa75da842c30efff6bf08e63 | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 02:52

Sharing

Report Analysis Logs

General

Target

data.dll
Size

858KB
MD5

42e3f49a018eb5a0ee676a62578da12d
SHA1

e116e28febd7c616096ddd555fbe50ca8a695bde
SHA256

3851aba3f60e2072e8f212cdf2f9aad9ac7c3b12073ddf4a1d278942791ed5aa
SHA512

ae2164e0313934843cf1d8556998dd143807114afc4e1844ad80c031cb140d37b652f8dd125831306e2dfeb3bb2b201bff4efc9059ea4d989c96b0b79b7df800
SSDEEP

24576:knaT/XRIUjl7nIjvk3FfAyzElA07q5H7WXfBSZaX2:JTPqUjl7nIRy707qdcBS4m

Score

10^/10

icedid 1101171172 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1101171172

C2

hdtrenity.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	regsvr32.exe
1740	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\data.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/1740-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download