icedid | 93046c670e85d02372a420e388ab0fb142a0ab3b047bacac84ba4cf7e6785aa0 | Triage

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
07-03-2022 12:20

Sharing

Report Analysis Logs

General

Target

93046c670e85d02372a420e388ab0fb142a0ab3b047bacac84ba4cf7e6785aa0.dll
Size

120KB
MD5

231094ba4a8a3584a78cfbe7f72413af
SHA1

2d6f8446d0e0f713a83c5c0a8d408dcf665e3e75
SHA256

93046c670e85d02372a420e388ab0fb142a0ab3b047bacac84ba4cf7e6785aa0
SHA512

8ffb95bf5a4e60b84751387210f99b520d200595a733fad253197a1430933e29719bb5325897e46f4417013db34fd5b58b8699220b0c33f5e07397f7f3a82ae0

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

400prettyboy.best

follerring.best

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2748-130-0x0000000010000000-0x0000000010006000-memory.dmp	IcedidSecondLoader
behavioral2/memory/2748-131-0x0000000010000000-0x000000001002D000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2740 wrote to memory of 2748	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 2748	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 2748	2740	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\93046c670e85d02372a420e388ab0fb142a0ab3b047bacac84ba4cf7e6785aa0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\93046c670e85d02372a420e388ab0fb142a0ab3b047bacac84ba4cf7e6785aa0.dll
2⤵
PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-130-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2748-132-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/2748-131-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download