icedid | 6e6a69b8584b2da246d9bd09316898d59154159a57e87fb4c8bdd02071f85cd6 | Triage™

Analysis

max time kernel
123s
max time network
150s
platform
windows10_x64
resource
win10
submitted
21/10/2020, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HlGKL.txt.dll
Size 272KB
Sample201021-32jbr476ee
SHA256 6e6a69b8584b2da246d9bd09316898d59154159a57e87fb4c8bdd02071f85cd6
MD5 a2525129ab640158c3334b1bf94156d5
SHA1 92a785cedc8e3fabdbb8e7b30e793761242ad964
SHA512 3af320fc5aa9f3a9768acd8ec24cd9803ab5dcbf27999a7ac34f0129c519b9b563af153ea21e99fd212a365cd4e27c4574a9308fdfe4758d7e230808ab5a5c30
MD5 SHA1 SHA512

Score

10^/10

icedid 1949629567 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1949629567

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 4 IoCs

flow	pid	Process
10	3932	rundll32.exe
12	3932	rundll32.exe
14	3932	rundll32.exe
16	3932	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3932	rundll32.exe
3932	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 3932	3856	rundll32.exe	68
PID 3856 wrote to memory of 3932	3856	rundll32.exe	68
PID 3856 wrote to memory of 3932	3856	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HlGKL.txt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HlGKL.txt.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads