icedid | c9a0d2f664277db1c90ebb2bc9549ef36d0fcd97332a47144ddaee0c1a2e725f | Triage

Analysis

max time kernel
4294213s
max time network
161s
platform
windows7_x64
resource
win7-20220310-en
submitted
15-03-2022 16:33

Sharing

Report Analysis Logs

General

Target

c9a0d2f664277db1c90ebb2bc9549ef36d0fcd97332a47144ddaee0c1a2e725f.dll
Size

460KB
MD5

afcdc096a7a22b16a2343bd1dd0fca4f
SHA1

f4eac2b02fcee42298b8b0352e4fd146fe97c9f5
SHA256

c9a0d2f664277db1c90ebb2bc9549ef36d0fcd97332a47144ddaee0c1a2e725f
SHA512

5db4c9c33781a747e82dd568214cf906a50c44371c83a5f9a4c29edbc4f4379bc0e44c14f8a67dc8047c4ba915011889c1e50b51a7da6155cc31777531737183

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

karimorodrigo.pw

airtopolos.best

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1880-55-0x0000000075270000-0x0000000075276000-memory.dmp	IcedidSecondLoader
behavioral1/memory/1880-56-0x0000000075270000-0x00000000752E7000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1888 wrote to memory of 1880	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1880	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1880	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1880	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1880	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1880	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1880	1888	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9a0d2f664277db1c90ebb2bc9549ef36d0fcd97332a47144ddaee0c1a2e725f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9a0d2f664277db1c90ebb2bc9549ef36d0fcd97332a47144ddaee0c1a2e725f.dll,#1
2⤵
PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1880-55-0x0000000075270000-0x0000000075276000-memory.dmp

Filesize
24KB

Download
memory/1880-57-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1880-56-0x0000000075270000-0x00000000752E7000-memory.dmp

Filesize
476KB

Download