icedid | bde2484fa3891b6b76039fb19e90102ca67fdae7c9de2a6a4bec34ba340c70d6

Analysis

Target

bde2484fa3891b6b76039fb19e90102ca67fdae7c9de2a6a4bec34ba340c70d6.dll
Size

251KB
MD5

348575b34fadd6b1196a1c7cb0659b2c
SHA1

cb719b86267c1198573a0d9c383dd60d35469e2a
SHA256

bde2484fa3891b6b76039fb19e90102ca67fdae7c9de2a6a4bec34ba340c70d6
SHA512

ed67c1be12814ca5cb5d9dc299e8d168a2ab4b9c0ee0300a30093794b51cf9b9af4024f272634d05c8d9e858e887d030f0758b5f10ac44c4ee9527175aaed2fd

Score

10^/10

Family

icedid

asewter.site

armyguerro.top

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 2 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2000-56-0x0000000074FC0000-0x0000000075019000-memory.dmp	IcedidSecondLoader
behavioral1/memory/2000-58-0x0000000074FC0000-0x0000000074FC6000-memory.dmp	IcedidSecondLoader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2032 wrote to memory of 2000	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2000	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2000	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2000	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2000	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2000	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 2000	2032	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bde2484fa3891b6b76039fb19e90102ca67fdae7c9de2a6a4bec34ba340c70d6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bde2484fa3891b6b76039fb19e90102ca67fdae7c9de2a6a4bec34ba340c70d6.dll
  2⤵
  PID:2000

memory/2000-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/2000-56-0x0000000074FC0000-0x0000000075019000-memory.dmp

Filesize
356KB

Download
memory/2000-57-0x0000000000170000-0x00000000001F0000-memory.dmp

Filesize
512KB

Download
memory/2000-58-0x0000000074FC0000-0x0000000074FC6000-memory.dmp

Filesize
24KB

Download
memory/2032-54-0x000007FEFC411000-0x000007FEFC413000-memory.dmp

Filesize
8KB

Download