icedid | f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727 | Triage™

Analysis

max time kernel
126s
max time network
145s
platform
windows10_x64
resource
win10
submitted
16/10/2020, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727.dll
Size 133KB
Sample201016-qvghgrrgfa
SHA256 f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727
MD5 8618deadab75f39b032b58f7f474a81f
SHA1 d7e7b126b04c075f0c2dd9a342715d0c3fa40045
SHA512 591fb32e980162cdf5c81537b576eba024ab0f7f58febea2cda67124b2309b515f1ee7cbc274316c2224e9207a12c19fff220f1e502a829e56e28ecf2a6f315b
MD5 SHA1 SHA512

Score

10^/10

icedid banker trojan

Malware Config

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 2 IoCs

flow	pid	Process
18	3944	rundll32.exe
20	3944	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3944	3828	rundll32.exe	69
PID 3828 wrote to memory of 3944	3828	rundll32.exe	69
PID 3828 wrote to memory of 3944	3828	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f56ea10521a52f78bedbf51c0bbdf9c894e473a73f1da8d388afc85b4c95f727.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads