icedid | ad7dfd8a04411cbe96ee8772a0f67da5ae2cf87bf13e0b286c2de937037cfb7e

Analysis

Target

ad7dfd8a04411cbe96ee8772a0f67da5ae2cf87bf13e0b286c2de937037cfb7e.dll
Size

232KB
MD5

98df07ecb8521689dd3a818674a56dba
SHA1

7174ff35230dfcbcd70bc6e4d84f299b717b990c
SHA256

ad7dfd8a04411cbe96ee8772a0f67da5ae2cf87bf13e0b286c2de937037cfb7e
SHA512

c91bbae26f5be163d1de34bc0de3de51af9c7abe9a2e3641f95fc1f7194a2ed616b06744092c3f3a37d17c428e2e61a02f7fcc5c9cdd21d64189cf868b55f6e0

Score

10^/10

Family

icedid

understandingtroll.cyou

rozathetroll.pw

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 3 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/1460-132-0x0000000000650000-0x00000000006EB000-memory.dmp	IcedidSecondLoader
behavioral2/memory/1460-134-0x0000000000650000-0x0000000000656000-memory.dmp	IcedidSecondLoader
behavioral2/memory/1460-135-0x0000000000651000-0x0000000000669000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1268 wrote to memory of 1460	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 1460	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 1460	1268	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad7dfd8a04411cbe96ee8772a0f67da5ae2cf87bf13e0b286c2de937037cfb7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad7dfd8a04411cbe96ee8772a0f67da5ae2cf87bf13e0b286c2de937037cfb7e.dll,#1
2⤵
PID:1460

memory/1460-130-0x0000000000650000-0x00000000006EB000-memory.dmp

Filesize
620KB

Download
memory/1460-132-0x0000000000650000-0x00000000006EB000-memory.dmp

Filesize
620KB

Download
memory/1460-133-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1460-134-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/1460-135-0x0000000000651000-0x0000000000669000-memory.dmp

Filesize
96KB

Download