icedid | 5fdeda1570ec0bb954576fc84ada2bff2bf0cd1c4e20bfea32752c8ddcd4e45e | Triage

Analysis

max time kernel
52s
max time network
113s
platform
windows7_x64
resource
win7v20201028
submitted
25-11-2020 21:55

Sharing

Report Analysis Logs

General

Target

Izezma64.dll
Size

133KB
MD5

dbb6e2b86d6fdaf27984ce81f5e1a159
SHA1

dee293054d1897ed8ee9d660665fffe18792a068
SHA256

5fdeda1570ec0bb954576fc84ada2bff2bf0cd1c4e20bfea32752c8ddcd4e45e
SHA512

a3d01c291cbd1ca6d329ac555e3165f48990ef1bc613e7c7e0287bf95e76da5202a76226f68e334e77435b1c447a275ef6c5c2ab94899e49ac849222c8cbd449

Score

10^/10

icedid banker trojan

Malware Config

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Core Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1996-1-0x0000000002CA0000-0x0000000002D46000-memory.dmp	Icedid_core

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 752 wrote to memory of 1996	752	regsvr32.exe	regsvr32.exe
PID 752 wrote to memory of 1996	752	regsvr32.exe	regsvr32.exe
PID 752 wrote to memory of 1996	752	regsvr32.exe	regsvr32.exe
PID 752 wrote to memory of 1996	752	regsvr32.exe	regsvr32.exe
PID 752 wrote to memory of 1996	752	regsvr32.exe	regsvr32.exe
PID 752 wrote to memory of 1996	752	regsvr32.exe	regsvr32.exe
PID 752 wrote to memory of 1996	752	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Izezma64.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Izezma64.dll
2⤵
PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-0-0x0000000000000000-mapping.dmp

Download
memory/1996-1-0x0000000002CA0000-0x0000000002D46000-memory.dmp

Filesize
664KB

Download