icedid | d361038582cbfaf03f9ee1fb8e82003ff2f0565bec49bd70167900de15fd0eb2 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19-03-2022 10:46

Sharing

Report Analysis Logs

General

Target

d361038582cbfaf03f9ee1fb8e82003ff2f0565bec49bd70167900de15fd0eb2.dll
Size

144KB
MD5

a827cdeac3f5f568e4b2f919332e6974
SHA1

aaf00d2edb2163653fd5affc0b48ece8e15d6ec8
SHA256

d361038582cbfaf03f9ee1fb8e82003ff2f0565bec49bd70167900de15fd0eb2
SHA512

cb581d387ff83f449a4d41bffa479ef7ff956384fc3fe68e0f37227bf473cfaefa102419d370abb9278cbfcab091a97db3eafa70b77d9f947d01d593fe6c5b85

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

pacificoceanposi.cyou

march42.pw

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/940-130-0x00000000752A0000-0x00000000752DF000-memory.dmp	IcedidSecondLoader
behavioral2/memory/940-132-0x00000000752A0000-0x00000000752A6000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3304 wrote to memory of 940	3304	regsvr32.exe	regsvr32.exe
PID 3304 wrote to memory of 940	3304	regsvr32.exe	regsvr32.exe
PID 3304 wrote to memory of 940	3304	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d361038582cbfaf03f9ee1fb8e82003ff2f0565bec49bd70167900de15fd0eb2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3304

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\d361038582cbfaf03f9ee1fb8e82003ff2f0565bec49bd70167900de15fd0eb2.dll
2⤵
PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-130-0x00000000752A0000-0x00000000752DF000-memory.dmp

Filesize
252KB

Download
memory/940-131-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/940-132-0x00000000752A0000-0x00000000752A6000-memory.dmp

Filesize
24KB

Download