icedid | f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727 | Triage™

Analysis

max time kernel
58s
max time network
114s
platform
windows7_x64
resource
win7v200722
submitted
16/10/2020, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727.dll
Size 133KB
Sample201016-qvghgrrgfa
SHA256 f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727
MD5 8618deadab75f39b032b58f7f474a81f
SHA1 d7e7b126b04c075f0c2dd9a342715d0c3fa40045
SHA512 591fb32e980162cdf5c81537b576eba024ab0f7f58febea2cda67124b2309b515f1ee7cbc274316c2224e9207a12c19fff220f1e502a829e56e28ecf2a6f315b
MD5 SHA1 SHA512

Score

10^/10

icedid banker trojan

Malware Config

Extracted

Family

icedid

rsa_pubkey.base64

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Core Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1692-1-0x0000000002D20000-0x0000000002DC7000-memory.dmp	Icedid_core

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1692	rundll32.exe
5	1692	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 1692	388	rundll32.exe	24
PID 388 wrote to memory of 1692	388	rundll32.exe	24
PID 388 wrote to memory of 1692	388	rundll32.exe	24
PID 388 wrote to memory of 1692	388	rundll32.exe	24
PID 388 wrote to memory of 1692	388	rundll32.exe	24
PID 388 wrote to memory of 1692	388	rundll32.exe	24
PID 388 wrote to memory of 1692	388	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-1-0x0000000002D20000-0x0000000002DC7000-memory.dmp

Download