icedid | bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243 | Triage™

Analysis

max time kernel
104s
max time network
105s
platform
windows7_x64
resource
win7v20201028
submitted
15/11/2020, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243.dll
Size 143KB
Sample201115-3c649h57da
SHA256 bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243
MD5 182b0a54d9e36db914beb8aa2cbe1d3b
SHA1 cba997f9290dd8f8d0a6d0e5c538834fbf195e8b
SHA512 009409f3e683e95fc07031ef0d951a501db02579a211630c225af65ca86864a1f11affaa97f41a3b299d671e18dc46baae13cf4c39cd3831e484ceabceb89495
MD5 SHA1 SHA512

Score

10^/10

icedid banker trojan

Malware Config

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Core Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1440-1-0x0000000002D00000-0x0000000002DA6000-memory.dmp	Icedid_core

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1440	rundll32.exe
6	1440	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1440	1080	rundll32.exe	25
PID 1080 wrote to memory of 1440	1080	rundll32.exe	25
PID 1080 wrote to memory of 1440	1080	rundll32.exe	25
PID 1080 wrote to memory of 1440	1080	rundll32.exe	25
PID 1080 wrote to memory of 1440	1080	rundll32.exe	25
PID 1080 wrote to memory of 1440	1080	rundll32.exe	25
PID 1080 wrote to memory of 1440	1080	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-1-0x0000000002D00000-0x0000000002DA6000-memory.dmp

Download